Reverse Engineering Stack Exchange
Reverse Engineering Stack Exchange

Most Popular

more tags
1500 questions
7
votes
1 answer

How to find if a given library function is used in a binary?

Assuming that library X is statically linked, is there a way to know with an acceptable grade of confidence if a function from it was used in the binary? I am currently using this approach: Convert the library function from its disassembly to its…
Not Now
  • 71
  • 2
7
votes
0 answers

running iOS debugserver on non-jailbroken devices

There are multiple tutorials on how to debug applications on jailbroken devices. These usually involves resigning debugserver, scp and running it from ssh with few tweaks to the entitlements and signature. Is there a way to the do the same thing on…
3asm_
  • 506
  • 6
  • 15
7
votes
5 answers

How to find out if PE executable was compiled with gcc or VisualStudio?

I looked at two ways so far. Both did not convince me in regard to false positives or false negatives: Using strings: How to retrieve the GCC version used to compile a given ELF executable? Using the linker version field in the PE header: Can I…
langlauf.io
  • 1,560
  • 1
  • 19
  • 36
7
votes
2 answers

Viewing MSSQL transactions between closed-source application and server

I am reversing a closed-source legacy application that uses Microsoft SQL Server (2005) and I would like to find out precisely what queries are being executed in the background. I understand that it may be possible to use Wireshark to view the…
jg0
  • 1,088
  • 11
  • 13
7
votes
2 answers

Import table vs Import Address Table

What's the difference between the Import Table and the Import Address Table?
Trey
  • 417
  • 3
  • 7
  • 20
7
votes
2 answers

Are there any free or low cost disassemblers for the Renesas H8 family of processors?

IDA Pro can deal with the Renesas H8 processors, but not the free version. Are there any free or low cost (<£100) disassemblers for the Renesas H8 family or processors?
Cybergibbons
  • 1,762
  • 2
  • 17
  • 26
7
votes
2 answers

IDA python, write to specific memory location

I am looking for a way to modify memory location in IDA python script. We can read memory with these functions: Byte(address) Word(address) Dword(address) When I try to do something like this: Byte(address) = value IDA says that it is not valid to…
user22310
  • 71
  • 1
  • 1
  • 2
7
votes
2 answers

How to label local variables in x64dbg

As the title stands, I want to label local variables ([ebp - x] addresses) the same way I do with functions and global variables. What I've learned: I found no way to label locals in the debugger window. There's Locals tab in the bottom panel. I…
Viacheslav Kroilov
  • 173
  • 1
  • 4
7
votes
1 answer

Understanding gdb output

So I was messing with gdb and came across something rather interesting. I ran the following code into gdb: int i, g = 1; for (i = 0; i < 100; i++) g++; Before execution, disas main yields: 0x000000000000064a <+0>: push %rbp …
Trey
  • 417
  • 3
  • 7
  • 20
7
votes
2 answers

Flash Reading by JTAG

I'm trying to read the flash memory of a microcontroller MPC5606B from Motorola. I saw his pins and saw that it uses jtag to perform debug, so I'm trying to use it JTAG interface to read its flash content. I read the MPC's flash content using a tool…
Daniel
  • 215
  • 3
  • 7
7
votes
1 answer

How can I check I've moved outside the stack without triggering a protection fault?

I'm adding a feature to my Linux debugger (I'm using Ptrace to manipulate the traced process as well as libbfd/libopcodes) to unwind the stack and determine if discrepancies exist between each CALL's allocated stack space and a statically derived…
zetavolt
  • 1,213
  • 11
  • 12
7
votes
4 answers

Where can someone interested in the topic learn more about Dynamic binary instrumentation?

Generally, it's a complex topic. There seems to be very little in the way of example or linear progression in to non-trivial examples. It's possible my google-fu is weak, but I can't seem to locate decent tutorials on using binary instrumentation…
RobotHumans
  • 563
  • 2
  • 16
7
votes
1 answer

Visual View in radare2 while debugging

I am using radare2 in debugging mode (r2 -d ./program). I set up a breakpoint at a certain address (db 0x12341234) And next I have entered Visual View using: V! Following some tutorials, I saw them using 's' to switch to the next instruction, but…
Florin
  • 143
  • 1
  • 2
  • 8
7
votes
1 answer

How can I determine if NAND blocks are good blocks?

I'm trying to rescue some data from our hardware. On the board I have a pair of Samsung k9f4g08u0d NAND chips. Each chip has been dumped to include every block, including the spare areas. If I invert every byte on the dumps and interleave both chips…
PaulS
  • 91
  • 2
7
votes
1 answer

lzma: File format not recognized [Details enclosed]

I'm trying to extract LZMA compressed data using binwalk but the fetched file is not being recognized. What am I doing wrong ? First I used binwalk to fetch some details as below : binwalk firmware.bin Output: DECIMAL HEXADECIMAL …
node_analyser
  • 211
  • 3
  • 8
1 2 3
…
99 100