Questions tagged [reverse-engineering]

Reverse engineering is the process of discovering the technological principles of a human made device, object or system through analysis of its structure, function and operation.

Reverse engineering often involves taking something (e.g., a mechanical device, electronic component, or software program) apart and analyzing its workings in detail to be used in maintenance, or to try to make a new device or program that does the same thing without using or simply duplicating (without understanding) any part of the original.

Reverse engineering has its origins in the analysis of hardware for commercial or military advantage. The purpose is to deduce design decisions from end products with little or no additional knowledge about the procedures involved in the original production. The same techniques are subsequently being researched for application to legacy software systems, not for industrial or defense ends, but rather to replace incorrect, incomplete, or otherwise unavailable documentation.

Reverse engineering techniques of Software consist of decompiling, analyzing, hooking, and patching.

See also:


  • Tracing a NCR assembly program of MASM walk-through of manually tracing and commenting a simple recursive function ing 16-bit x86 asm source to C-like pseudocode. With discussion of how to analyse and what to look for in finding the data flow.
3872 questions
1
vote
1 answer

How do bitwise operations work on expressions within variable assignments in C/C++?

I'm learning reverse engineering, and I have the following snippet which I am trying to make sense of: var = strcmp("C:\\Windows\\System32\\svchost.exe", pe.szExeFile); if (var) var = -(var < 0) | 1; if (var) { // additional code here } I think…
1
vote
1 answer

How to connect to docker via VNC when the docker image is not made by you?

I'm trying to get started with PANDA RE, a framework developed by MIT Lincoln Lab for Reverse Engineering. Their website says that beginners should try the tool through docker first. Therefore, I pulled their image and got it to run with the command…
Moltres
  • 600
  • 4
  • 21
1
vote
1 answer

How does `git add` deal with changes like file<->directory?

This is a long question. I'm trying to reverse-engineer some basic Git functionalities, and am having some trouble wrapping my head around what git add really does under the hood. I'm already familiar with the three trees of Git, and that the index…
Eldrax
  • 499
  • 4
  • 12
1
vote
1 answer

Determine build tools version from APK file

Is it possible given a released APK file to know the Android build tools version used, especially with utilities like zipalign and apksigner that has been applied to the APK file?
Nederealm
  • 447
  • 4
  • 15
1
vote
0 answers

Comparison of hexadecimal value with '\0'

i decompiled some code and stumbled across an if-statement which I cannot make sense of. if (y < '\0') with y = 0xED. As far as I understand, '\0' is NULL or 0x00. In my mind, it would not make sense to compare a number to a character but even if…
HBHugo
  • 11
  • 2
1
vote
1 answer

Assembly Visualizer

I did some looking around to find an assembly visualizer kind of how Regex sites show you explain it, or the BF (language) visualizer when shows you how its going through the stack, is there something like this for assembly somewhere…
1
vote
0 answers

How to skip an IntPtr Struct to go to the second IntPtr Struct

I've been trying to get an old game working and think I have found the issue. In the code below It shows "IntPtr" and "IntPtr2". I think the first IntPtr containing Settings.Default.XTrapArgKey needs to be somehow bypassed or disabled so the game…
1
vote
0 answers

GPIO programming on Gigabyte motherboards

I have IMB310TN motherboard with 8 GPIO pins. I'd like to use them, but there is no documentation about it. Gigabyte support responded, that documentation is confidential :). As I see, similar GPIO pins exists on various Gigabyte motherboards, so…
Jarek
  • 329
  • 2
  • 13
1
vote
0 answers

cannot read property key of undefined in FRIDA

I am hooking an app now i m founding this error i have already tried many solutions one of which is following: Java.perform(function() { var main; Java.choose('ca.c.edu.char.g', { onMatch: function(instance) { …
Hacker111
  • 65
  • 1
  • 5
1
vote
1 answer

How does polymorphic code work on the .exe file

I'm writing a paper on malware and malware analysis and would like to include a bit on polymorphic malware(Code that changes itself), not to be confused with polymorphism is OOP. My hypothesis is that it changes the function names which change the…
grim_ops
  • 11
  • 1
1
vote
1 answer

reversing Android Market app network traffic

Source code of Android Market app is not available. What I want to do is reversing the network protocol used by the market. The purpose is to build a tool that can simulate a handset and search for a particular phrase, thus returning the rank of a…
Raffaele
  • 20,627
  • 6
  • 47
  • 86
1
vote
0 answers

What happens in the assembly to an inlined external library function?

Let's say I'm using a c or c++ library (B) (with eventually inline and templates in header) that I use as a dynamic library (B) in my own library (A) or program. What happens to the functions in the final assembly A (so/dll) ? In particular, if it's…
Soleil
  • 6,404
  • 5
  • 41
  • 61
1
vote
1 answer

How to "map" a binary to a an architecture + libc version?

I am wondering if there is a simple way in Linux, or maybe an existing open source project that will allow me to provide it a binary or firmware image and it will return both the architecture (aarch64, armv7-eabihf, armv7m, etc.) and the libc type…
gatorface
  • 85
  • 6
1
vote
1 answer

What are these BMP (8-bit, not compressed) bytes?

I'm looking at the bytes for an 8-bit BMP bitmap with 0 set as number of colors in palette, and 0 set as important colors, and I want to figure out what the bytes represent beginning at index 54 and ending at index 1077. Index 1078 is where the…
1
vote
1 answer

Determining the called JSON file in Javascript to use in cURL for data mining - twitter like 'more' button

I'm trying to extract a stream of historical messages of a site much like twitter. Basically we all know the 'MORE' button it Twitter. This site has something similar and looks like it grabs a JSON object and parses it. How can I figure out…
NightWolf
  • 7,694
  • 9
  • 74
  • 121