Questions tagged [reverse-engineering]

Reverse engineering is the process of discovering the technological principles of a human made device, object or system through analysis of its structure, function and operation.

Reverse engineering often involves taking something (e.g., a mechanical device, electronic component, or software program) apart and analyzing its workings in detail to be used in maintenance, or to try to make a new device or program that does the same thing without using or simply duplicating (without understanding) any part of the original.

Reverse engineering has its origins in the analysis of hardware for commercial or military advantage. The purpose is to deduce design decisions from end products with little or no additional knowledge about the procedures involved in the original production. The same techniques are subsequently being researched for application to legacy software systems, not for industrial or defense ends, but rather to replace incorrect, incomplete, or otherwise unavailable documentation.

Reverse engineering techniques of Software consist of decompiling, analyzing, hooking, and patching.

See also:


  • Tracing a NCR assembly program of MASM walk-through of manually tracing and commenting a simple recursive function ing 16-bit x86 asm source to C-like pseudocode. With discussion of how to analyse and what to look for in finding the data flow.
3872 questions
1
vote
1 answer

How to automate finding data in a memory of another running process?

How to automate finding data in a memory of another running process? Because of dynamic memory allocation every time memory addresses are different. Currently I search for needed values by Cheat Engine. But I'm curious how game trainers every time…
JustOneMan
  • 231
  • 1
  • 9
  • 34
1
vote
1 answer

How can I figure out what a text file is compressed with?

I'm trying to decompress this text file (ClientSettings.sav) on my hard drive. The original size of the file is around 28kb, and it's been compressed down to 2kb. I'm unsure what steps to take from here as I'm not too experienced with this, and was…
sha1
  • 19
  • 1
  • 6
1
vote
0 answers

How to ignore thread switches and analyze a single thread

I am currently using x64dbg to analyze a multi-threaded program. Every time a thread switches, x64dbg automatically breaks, which happens frequently. I want to focus on analyzing one thread. Is there any way to disable the break on thread switches…
Rendon
  • 11
  • 3
1
vote
0 answers

Float operations in Z3 SMT

I'm trying to find a key that fulfills these conditions: Key length is 19 characters Characters in the ASCII range are from 0x30 to 0x5F Key[1] same as key[2] Summary of all characters is 1418 (decimal) Summary of sum_mul_pi function is 39944…
fritz
  • 111
  • 1
  • 11
1
vote
0 answers

Understanding an application launch from web

I'm curious as to how an application is being launched from a web control panel. I am using Splashtop Business, a remote desktop management system. The system allows one to select a workstation to connect to, select "Connect", and the native app…
robinspi
  • 93
  • 7
1
vote
0 answers

win32 debug api: multithreaded debugging - set current thread

I am writing a little tracer using the Win32 Debug Api (not dbgeng). The general flow is: DEBUG_EVENT event; WaitForDebugEvent(&event); ... ContinueDebugEvent(event.pid, event.tid,...) My question is: How can I switch the debugger to a different…
1
vote
1 answer

IDA Python + Qt. How can I insert my own tab into IDA main tab widget?

I'm developing my first IDA Pro plugin in Python 3 + PyQt5 using IDA API. Now I'm able to create any detached window (QMainWindow, QDialog, etc.) with any contents but I want to insert it into the IDA main tab widget (like "IDA View-A", "Hex…
nomad
  • 61
  • 4
1
vote
0 answers

no output after depacking C packed script with UPX

I learn how to pack then unpack scripts with UPX and C language. Here is my script which I packs: it is quite simple, just types string "hello world" on a screen. Well, I pack it using next commands: gcc -m32 main.c -o main upx main.exe -o…
Mark Minerov
  • 309
  • 1
  • 8
1
vote
1 answer

`test reg, const` when `reg` contains a memory address

While trying to reverse engineer a "crackme" binary, I stumbled upon a function that starts like this: mov ecx, [esp+4] test ecx, 3 jz short loc_106A9F0 The first argument for the function (which is MOV'd to ECX in the first line of the function)…
OreOS
  • 43
  • 1
  • 6
1
vote
0 answers

Why Android Emulator receiving SIGTRAP after int 3 instruction?

I am using IDA 7.5 and Android Emulator ( I tried many version of emulator, like BlueStack etc) trying to debug a native code inside a apk (.so file ). Launch apk, IDA select remote linux debugger ( most of Android Emulator are x86 image. ), attach…
1
vote
0 answers

Ghidra doesn't find the functions

Im pretty new at reverse engineering and I use Ghidra and IDA Pro. But I try to use Ghidra more because of the decompiler. But right now I really don't know what to do because Ghidra doesn't want me to show the functions when I open the exe-File in…
LeSunset
  • 11
  • 2
1
vote
2 answers

Exporting function symbols from symtab to dynsym

My goal is to make symbols visible for dlsym for futher use. Currently all symbols are in the .symtab I tried using LIEF to export them, but always got Exec format error after modification my elf file: ELF 64-bit LSB executable, x86-64, version 1…
Honza Bednář
  • 396
  • 4
  • 14
1
vote
0 answers

Strip filenames from Swift binary

Even when applying the highest level of stripping to my Swift binary, I can still see that the compiler embeds filenames as strings into the app binary, which I can then view using Hopper. I'm not necessarily convinced that anyone could do anything…
Jonathan Ellis
  • 5,221
  • 2
  • 36
  • 53
1
vote
1 answer

How to hook/convert __userpurge func to __stdcall or __cdecl?

Know anybody something about hooking __userpurge type of functions? I hooking successfully __thiscall, __stdcall, __cdecl, __usercall. How to hook this type of functions using translation to __stdcall or __cdecl? Function who i must hook at first…
Svisstack
  • 16,203
  • 6
  • 66
  • 100
1
vote
0 answers

Hooking into constructor of SecretKey and Mac not works Frida

Recently i tried to get value of secret key used to HMAC but i'm unable to hook into constructor. Here is my frida code: var secretKey = Java.use("javax.crypto.spec.SecretKeySpec") var mac = Java.use("javax.crypto.Mac") …
Kaspek
  • 159
  • 1
  • 11