Stack Overflow
Stack Overflow

Questions tagged [reverse-engineering]

Reverse engineering is the process of discovering the technological principles of a human made device, object or system through analysis of its structure, function and operation.

Reverse engineering often involves taking something (e.g., a mechanical device, electronic component, or software program) apart and analyzing its workings in detail to be used in maintenance, or to try to make a new device or program that does the same thing without using or simply duplicating (without understanding) any part of the original.

Reverse engineering has its origins in the analysis of hardware for commercial or military advantage. The purpose is to deduce design decisions from end products with little or no additional knowledge about the procedures involved in the original production. The same techniques are subsequently being researched for application to legacy software systems, not for industrial or defense ends, but rather to replace incorrect, incomplete, or otherwise unavailable documentation.

Reverse engineering techniques of Software consist of decompiling, analyzing, hooking, and patching.

See also:

  • Tracing a NCR assembly program of MASM walk-through of manually tracing and commenting a simple recursive function ing 16-bit x86 asm source to C-like pseudocode. With discussion of how to analyse and what to look for in finding the data flow.
3872 questions
1
vote
0 answers

Need clarification on understanding this code (Finding two secret numbers given C code and Assembly Code)

This is for one of my classes. We are given two files. One that contains C code: guess_two_numbers.c #include void print_error() { printf("\n Oooops, incorrect guess!\n"); exit(1); } int main() { int num1, num2; printf("\n Guess…
bob jones
  • 11
  • 2
1
vote
1 answer

Windbg symbols for Windows XP

So I have a problem getting symbols (such as ntdll.pdb) for Windows XP x86. I know that in the past you could download these symbols, but today you can only do this from the microsoft servers like mantioned here The problem is that my XP machine…
0xmarsh
  • 51
  • 5
1
vote
1 answer

Understanding what this x86 assembly function does, recursion

I have this Assembly function here, and have run through it multiple times trying to understand what it does and what the pattern is. I have hit a brick wall in terms of understanding it's pattern. Any form of guidance is appreciated here. …
peter k
  • 108
  • 1
  • 8
1
vote
1 answer

Buffer Overflow Exploit over using TCP won't keep shell open

I have crafted a buffer overflow exploit for a remote machine for this CTF. The challenge prints out an address, which you then have to use in order to know where your shellcode is being stored. Attached is my current exploit code: if len(sys.argv)…
stigward
  • 127
  • 13
1
vote
0 answers

How to secure Android Manifest and string xml using Proguard

I tried using proguard to protect the code from reverse engineering below is my code. But still, all my resource files are not obfuscated. # debugging stack traces. -keepattributes SourceFile,LineNumberTable -dontwarn…
Ritu Nambath
  • 51
  • 8
1
vote
3 answers

c++ class disassembly

I have the following code: class Base { public: int x,y; Base() { x=10; y=20; } virtual void myfunction() { } }; int main() { Base *b = new Base(); return 0; } The disassembly gives me something like: push 0Ch ; size of Base call…
user277465
1
vote
2 answers

Do standard library containers have unused variables in their structure?

I've been doing a bit of reverse engineering on an application, and have managed to identify a couple of standard library containers, like std::vector and std::map, but what I found using std::map as an example is that it has 20 bytes between the…
Diab
  • 124
  • 1
  • 10
1
vote
0 answers

bomblab phase_6: Where did I make mistake?

This is the code of node6. 0x00005555555558ab <+0>: endbr64 0x00005555555558af <+4>: push %r14 0x00005555555558b1 <+6>: push %r13 0x00005555555558b3 <+8>: push %r12 0x00005555555558b5 <+10>: push %rbp …
NaHoGu
  • 33
  • 5
1
vote
1 answer

Extract resources from a SFS file

I would like to extract resources from a resources file which magic key is SFS. I don't find any documentation about this file type nor any tools to extract resources from this file type. It's resources of a 1997 game.
gsempe
  • 5,371
  • 2
  • 25
  • 29
1
vote
1 answer

What is @object in **ELF**

_thread int errno; int get_errno() { return errno; } And when i am disassembling it i am getting for x86 .globl errno .section .tbss,"awT",@nobits .align 4 .type errno, @object .size errno, 4 errno: .zero 4 movl …
abhinav tiwari
  • 11
  • 1
1
vote
0 answers

x64dbg assembly instruction changes are not present after restarting debuggee in debugger

I have the Sep 14 2020 20:15:12 release of x64dbg and Windows 8.1. I am new to using a debugger, and maybe this is a simple fix, but if I press space and change an assembly instruction and then restart with CTRL+F2, the change I made no longer…
Bort
  • 133
  • 5
1
vote
0 answers

Look at what functions are being called Google Chrome

There are several posts with similar question as mine but none seem to answer my issue. I am currently working to reverse engineer a site where a JavaScript file is being loaded in under sources. For example purposes I will refer to it as foo.js.…
Joe
  • 85
  • 12
1
vote
1 answer

Will Flutter code be reverse-engineered easily without obfuscation?

I know Flutter is compiled AOT (ahead-of-time). However, it seems that all the method/class/field/... names will still be visible in the final compiled output (.apk or .ipa). I know obfuscating can use non-readable strings to replaces such names,…
ch271828n
  • 15,854
  • 5
  • 53
  • 88
1
vote
2 answers

Get weight data from bluetooth le scale by disassemble manucaftures library

a friend has a body scale with Bluetooth Le. To save his weight measurements he has to open the Manufactures App on his phone. So we try to use his raspberry pi for the Job. We find out, that the scale sends the data over advertisments. The scale is…
Christian
  • 23
  • 8
1
vote
1 answer

Why the differences in memory address or offset between xxd and objdump?

I have the following test assembly program: .section .rodata a: .byte 17 .section .text .globl _start _start: mov $1, %eax mov a(%rip), %ebx int $0x80 And I've compiled into an executable called file. When I use objdump to disassemble…
samuelbrody1249
  • 4,379
  • 1
  • 15
  • 58
1 2 3
…
99
100