Questions tagged [reverse-engineering]

Reverse engineering is the process of discovering the technological principles of a human made device, object or system through analysis of its structure, function and operation.

Reverse engineering often involves taking something (e.g., a mechanical device, electronic component, or software program) apart and analyzing its workings in detail to be used in maintenance, or to try to make a new device or program that does the same thing without using or simply duplicating (without understanding) any part of the original.

Reverse engineering has its origins in the analysis of hardware for commercial or military advantage. The purpose is to deduce design decisions from end products with little or no additional knowledge about the procedures involved in the original production. The same techniques are subsequently being researched for application to legacy software systems, not for industrial or defense ends, but rather to replace incorrect, incomplete, or otherwise unavailable documentation.

Reverse engineering techniques of Software consist of decompiling, analyzing, hooking, and patching.

See also:


  • Tracing a NCR assembly program of MASM walk-through of manually tracing and commenting a simple recursive function ing 16-bit x86 asm source to C-like pseudocode. With discussion of how to analyse and what to look for in finding the data flow.
3872 questions
1
vote
2 answers

How do I discover properties of an IPropertyBag?

Besides a dictionary attack, what can I do? I'm trying to find out what properties do DirectShow filters have. I know one of the properties is FriendlyName (that's the only one MSDN mentions), so I tired searching for it through quartz.dll with a…
Ansis Māliņš
  • 1,684
  • 15
  • 35
1
vote
0 answers

How can I identify this "search syntax" or "query language"?

Can anyone identify this 'search syntax' or 'query language' ? I am looking for a more complete specification. There is one operator: = All strings are case-insensitive, limited to 7-bit Whitespace is significant Queries are of the form: …
1
vote
0 answers

GDB disassembly, what is the -0xc(%rbp) position?

I am in school and doing an assignment where I disassembly binary files and then interpret them and build a c++ program from them (reverse engineering). My main question is what does the "c" position represent when referring to the rbp. Normally…
1
vote
0 answers

tab completion in radare2 gives seg fault

I'm new to radare2 ans was previously using it on Ubuntu or Kali. I switched to Manjaro 20.2 and noticed that whenever I press the [TAB] it ends up in a segmentation fault something like this: >> r2 hello [0x00001040]> aa [x] Analyze all flags…
1
vote
0 answers

GetVersionInfoSizeEx() failing on a DLL, but not on a copy of the same

Occasionally when deploying my app* a seemingly random one of the bundled DLLs gets in a strange state. On the instance I'm debugging now it's System.Net.Security.dll (from .NET Core 3.1), but it could be any. In Explorer, the DLL shows no version…
Sijmen Mulder
  • 5,767
  • 3
  • 22
  • 33
1
vote
1 answer

How can I figure out which framework was used for build desktop application's (Zoom) UI?

I would like to know which framework was used to build Zoom(windows & mac)'s UI. Is that possible somehow? Would decompiling help? Zoom's desktop application
Garam
  • 31
  • 2
1
vote
2 answers

Python Cheats pymem address

in the sample script import pymem import pymem.process import pymem.memory process = pymem.process mem = pymem.memory DMC5 = pymem.Pymem("Game.exe") DMC5_base = DMC5.process_handle adress = 0x1F1BFF714C8 value =…
1
vote
0 answers

Offset Calculation is incorrect based on VirutalAddress Property in PE Section Header

I have created a simple .exe file with flat assembler which is actually doing nothing but just having one instruction format pe64 use64 section '.text' code executable readable mov eax, 20 After created i opened the executable in Ghidra which…
user7145038
1
vote
1 answer

Disassembling CGWindowContextCreate()?

From past few days I am trying to find out the location of CGContextRef on screen and window at Graphics Layer of OS X architecture (mostly in quartz). I think in order to create a window one must pass the location and size of that window where it…
RLT
  • 4,219
  • 4
  • 37
  • 91
1
vote
1 answer

Does reading a debug register raise an exception if the GD flag is set?

I've been doing some research on debug registers lately and how some malware programs are able to manipulate them as an anti-debugging tactic. One of the things I have read a few times now is that this can be prevented by using the General Detect…
Rahl2500
  • 13
  • 3
1
vote
1 answer

What exactly does the selectnbrecv function from Go do?

I'm reverse engineering a Go binary and came across the function selectnbrecv. However, I don't understand the documentation. I'll appreciate it if someone can explain to me the context and operation of the function. Thanks!
Newbie
  • 591
  • 1
  • 5
  • 11
1
vote
2 answers

Core Wars 8086 safe challenge (Safe uses addition on a memory address)

I'm doing a safes competition and I got this safe: start: add ds:0DEDh, ax xor cx, cx loop start From my understanding, cx will be 0 at the end of the loop and will change to FFFF at the next iteration. I also know the 0xCCh is an…
nit17
  • 47
  • 5
1
vote
1 answer

ApkTool splits java files in to multiple files

Im using ApkTool to dessasemble DEX files from an APK to recover smali code. I have noticed that the .java file has been splitted in different files. For example: MainActivity.java -> MainActivity.smali, MainActivity$1.smali FirstFragment.java ->…
orapic
  • 23
  • 2
1
vote
0 answers

How to step into native code with disassembling in Android Studio?

I am trying to step into(F7) a native function in Android Studio, but it steps over. I want to step into the native function by LLDB, and disassembling the function. How to step into a native library(so) without native source code(CPP) in Android…
1
vote
0 answers

Trace all function from native library Android

i have an answer about the way to trace all functions from Native Library. For example, its name is "libexample.so". There are no results by when searching for this module Process.findModuleByName("libexample.so"). That library dinamically loaded…
Biornes
  • 11
  • 1
1 2 3
99
100