The tag has no wiki summary.

learn more… | top users | synonyms

1
vote
1answer
138 views

Difference Between Binary Exploitation and Reverse Engineering?

I am a beginner in Reverse Engineering and am trying to improve my skill by participating in any CTF's I can and solving CrackMe's. I am trying to find out why Binary Exploitation and Reverse ...
1
vote
3answers
426 views

Debugging and DLL-Injection

Hi, I am currently reading Gray Hat Python to learn about Debugging and various interesting techniques for binary analysis. So far I have learned an amazing amount of stuff (just read about ...
2
votes
1answer
105 views

Use of openssl could be a weak point in an Android App?

I'm reviewing an Android app (consists of Java and C source). There are complicated obfuscation steps in the build process (for content protection). But it uses statically linked openssl library ...
2
votes
1answer
86 views

Supplying a password to PBKDF2 in raw binary vs. base64?

Background: I'm working with Node's crypto library. I'm using PBKDF2 to convert a variable-length binary "passphrase" into constant-length keys for an AES cipher later on. The underlying source of ...
5
votes
3answers
167 views

Trust Issues Relative to Open Source

Two separate discussions have very recently opened my eyes to an issue I had not considered – how to confirm the Open Source binary one uses is based on the published source code. There is a large ...
4
votes
1answer
148 views

auditing open source compiler binaries for trojans

It is a well known vulnerability that a properly altered compiler binary can transfer itself to new binaries of the compiler, and still be entirely absent from the source code. But how real is this ...
16
votes
1answer
466 views

Is there a way to verify a binary against the sources?

It seems like there is no practical way to verify the full integrity path of precompiled and packaged software? I can check the downloaded package itself by hashes, but I have no verification if the ...
7
votes
3answers
363 views

Is it safer to compile open source code vs simply running the binary?

I understand that with OpenSource software, my milage may vary based on the trust of the author and the distribution platform they use (Codeplex, Git, or private server). Oftentimes a FOSS website ...
16
votes
8answers
4k views

Any comprehensive solutions for binary code protection and anti-reverse-engineering?

Does anyone know of good products with comprehensive binary hardening and anti-reverse-engineering features? Or better, has anyone seen an independent review comparing products that perform these ...
1
vote
1answer
142 views

How to run client's code on server securely

I'm working on a project basically a web application. It accepts code (java, c, c++) from client, compile and execute on server and return the results back to client. As I'm going to execute code on ...
3
votes
5answers
608 views

Does a binary executable have to have some critical plain-text components?

When companies package binary executables, they are often encrypted, compressed, scrambled, and otherwise made so that your lazy hacker can't simply open the program up in Notepad++ and see the code. ...
2
votes
2answers
248 views

Are GUID visible when compiling a .NET project?

I know if a person has a GUID from a machine that person can figure out if other guid belongs to that machine. In a .NET project (csproj and the visual studions solution file) GUIDs are generated. If ...
5
votes
3answers
884 views

Does the endianness used with an encryption algorithm affect its security?

I'm implementing the AES block cipher, which reads/writes data in 16 byte blocks. The implementation I'm working with usually read data in the little endian format. But in my platform the endianness ...
16
votes
4answers
2k views

What is the corrupted image vulnerability? How does it work?

What exactly happens when someone injects malicious binary code into an image file (on Windows)? How is that done?
19
votes
4answers
25k views

How to inject executable, malicious code into PDF, JPEG, MP3, etc.?

I wanted to know if its generally possible to inject executable code into files like PDFs or JPEGs etc., or must there be some kind of security hole in the application? And if so, how would one do ...
10
votes
5answers
2k views

Storing private asymmetric key in application binary?

I would like to give a daemon-style process (i.e. no user interaction) access to a shared secret key so that it can access a shared, encrypted data file. User applications accessing the same encrypted ...
13
votes
5answers
965 views

Code Analysis: Binary vs Source

While conducting a software security assessment, if you have access to the source code of a compiled application (say C++), would you ever do any analysis upon the compiled version, either with any ...