Most Popular

1500 questions
10
votes
2 answers

Radare2 C output

I made a simple hello world program, and put it in radare2. I then ran the pc command, which displayed C output. The output was this: #define _BUFFER_SIZE 256 const uint8_t buffer[256] = { 0x55, 0x48, 0x89, 0xe5, 0x48, 0x83, 0xec, 0x10, 0x48,…
LifeInKernelSpace
  • 101
  • 1
  • 1
  • 4
10
votes
2 answers

What is the purpose of these instructions before the main preamble?

I wrote a small C program below: #include int sub(int x, int y){ return 2*x+y; } int main(int argc, char ** argv){ int a; a = atoi(argv[1]); return sub(argc,a); } Compiled with gcc 5.4.0 and target 32 bit x86. I got the…
drdot
  • 279
  • 4
  • 10
10
votes
1 answer

How .reloc Section is used in PE file?

I have read document pecoff_v83 of Microsoft. In The .reloc section part, I have read: The Fix-Up Table contains entries for all fixups in the image. The Total Fix-Up Data Size in the Optional Header is the number of bytes in the fixup table. The…
QChí Nguyễn
  • 323
  • 1
  • 4
  • 14
10
votes
1 answer

How to find entry point in .exe?

Kind of a simple question. How does a program like IDA locate the entry point of an exe? If I wanted to, could i find this with just a hex editor manually?
user3457614
  • 111
  • 1
  • 1
  • 3
10
votes
2 answers

Is there an easy way to detect if the SSDT has been patched from a memory dump?

The SSDT is a dispatch table inside the Windows NT kernel, and it is used for handling calls to various internal kernel APIs. Often malware will change addresses in the SSDT in order to hook certain kernel functions. Spotting this kind of thing in a…
Polynomial
  • 1,272
  • 2
  • 12
  • 21
10
votes
1 answer

Draw circuit of a multilayer PCB

I have found a multilayer PCB of which I need to draw the circuit. At first, I tried to find the circuit on the internet using part numbers, but I did not get any result. The PCB is from a very old alarm installation. Are there any tools or…
user187
10
votes
3 answers

Can you decompile Actionscript 3 on a Mac?

Reverse engineering SWFs with ActionScript 3 on a Mac typically requires a Windows VM and a lot of copying and pasting. There are some good decompilers for Windows such as as3extractor but I haven't found anything that seems to work on MacOS X. Does…
Jay
  • 101
  • 2
  • 5
10
votes
4 answers

Control flow graph reconstruction projects

I'm looking for projects providing reconstructed Control Flow Graphs from binaries while supporting more than one platform (e.g. x86, x64, arm). For example, considering this short assembler program: .global main .intel_syntax noprefix .extern…
Nordwald
  • 2,896
  • 13
  • 25
10
votes
4 answers

Where do I find a cheap hardware USB sniffer

I wanto to capture and then process the USB data that is sent from a computer to a USB printer. I know that there are several software sniffers like Wireshark that can do that. But I need a hardware solution that does the capture and sends the…
Elmue
  • 441
  • 2
  • 4
  • 11
10
votes
5 answers

Lifting up binaries of any arch into an intermediate language for static analysis

Background As the title is self-explanatory, I would like to translate binaries of any architecture (e.g. x86, ARM, ARM Thumb) to an intermediate language in order to apply arch-independent static analysis. To be exact, my work is confined to the…
frogatto
  • 205
  • 2
  • 8
10
votes
2 answers

Java byte code equivalent of IDA function signatures

I remember IDA (Interactive Disassembler) has a really neat feature of function signatures where you don't have to reverse engineer code found inside standard libraries. Is there a similar feature for Java byte code, especially for obfuscated code?
Dr Deo
  • 123
  • 9
9
votes
1 answer

Equivalent of IDA FLIRT signatures for GDB?

Are there equivalent tools/procedures to IDA's FLIRT signatures, when working on statically linked binaries, with other disassemblers? Is it at all possible with GDB/objdump?
Jesper.Reenberg
  • 293
  • 2
  • 13
9
votes
1 answer

Saving program execution state for fuzzing

Suppose I have a program that has two functions, functionA and functionB called sequentially. functionA requires a significant amount of processing in order to execute, and in the course of the execution sets up and maintains many global variables…
amccormack
  • 1,326
  • 2
  • 13
  • 29
9
votes
1 answer

Becoming A Better Reverse Engineer

I have been looking on the net and all I see when it comes to reverse engineering are a bunch of silly crackme tutorials. I want to be better at taking code from assembly to c or c++. I am getting the feeling that I am going to have to have to pick…
LUser
  • 783
  • 1
  • 4
  • 22
9
votes
2 answers

How to extract functions from one executable to include/link in another

I'm wondering what are the options (aside from attempting disassembly/decompilation and reassembly/recompilation) one has when it comes to extracting a series of functions from one binary, compiled for a specific platform and architecture and…
Roberto Andrade
  • 346
  • 3
  • 4
  • 13