Reverse engineering is the process of discovering the technological principles of a human made device, object or system through analysis of its structure, function and operation.

learn more… | top users | synonyms

36
votes
15answers
6k views

Should we protect web application source code from being stolen by web hosts through obfuscation?

Is it worth to obfuscate a java web app source code so that the web host cannot make wrong use of the code or even steal your business? If so, how should this be dealt with? How should we obfuscate? ...
33
votes
4answers
5k views

Why does malware periodically check google.com

I'm looking at some malware PCAPs, e.g. http://malware-traffic-analysis.net/2014/05/27/index.html . One of the things I've been seeing frequently is requests to alexa top million sites (e.g. yandex, ...
26
votes
5answers
2k views

Why would malware try to remove other malware?

Recently my php-based website got infected with malware (probably by a stolen ftp password). Basically, every 30 minutes a file frame_cleaner_php.php was uploaded, a HTTP-GET was done on it to execute ...
26
votes
5answers
2k views

How valuable is secrecy of an algorithm?

On the surface, the inadvisability of security through obscurity is directly at odds with the concept of shared secrets (i.e. "passwords"). Which is to say: if secrecy around passwords is valuable, ...
17
votes
6answers
2k views

Becoming a malware analyst?

So, I'm currently 16 and am considering a career in IT when I finish school. The thing that has intrigued me the most while growing up is malware. I've come across it so often and have often had to ...
17
votes
7answers
5k views

Any comprehensive solutions for binary code protection and anti-reverse-engineering? [closed]

Does anyone know of good products with comprehensive binary hardening and anti-reverse-engineering features? Or better, has anyone seen an independent review comparing products that perform these ...
13
votes
2answers
8k views

Facebook API : App Secret - possible misuse

I've recently find out that by simple quick look into compiled code of one of our applications, you can get both App ID (API Key) and App Secret for Facebook API I suppose that we should really keep ...
11
votes
4answers
2k views

Preventing reverse-engineering of client application

I have a web service which is used by a Flash client. Both the service and the Flash client is produced by me (read: my company). The Flash client communicates with the server over HTTPS. One of the ...
10
votes
4answers
486 views

How can I audit which type of Block Mode encryption is being used when no source code is available?

Given that there are clear advantages to using some block modes of encryption over another, and I would like to ensure that all software used in the enterprise uses a certain "level" of security I'd ...
8
votes
3answers
1k views

Vuln research: reverse engineering, debugging or fuzzing?

I wonder how hackers find vulnerabilities. If they use fuzzing, security engineers do it, and it's probably that security engineers (that work in a firm) have more resources than a group of hackers. ...
8
votes
1answer
628 views

What role does cryptography play in anti-piracy?

As a follow-up to Cipher for Product Registration, are there secure yet usable cryptographic standards/protocols for protecting software and data used by software? I'm interested in hardware and ...
7
votes
3answers
5k views

Reverse engineering and Java

Is java class file or jar file is easy to reverse engineer? Because java generates a class file after compilation and not exe files. Is jar and class files are easy to decompile compare to c# and C++? ...
7
votes
3answers
411 views

Is initializing variable to NULL or 0 or -1 a bad practice from security standpoint?

I'm trying to learn little bit about armoring application against reverse engineering. In one article I read that initializing variables to NULL or 0 or -1 is as secure (vs RE) as using common ...
6
votes
4answers
4k views

How to harden an iPhone/Android app so its tough to reverse-engineer it?

These are the following objectives I have in mind: Make the app hard to crack, as the binary will hold some secret tokens. If it still can be cracked, is there any way the app can tell someone or ...
6
votes
3answers
837 views

Global check of input/output of known hash functions

Is there a website, application, or script that will allow you to give an input/output for a hash function, run these against known functions, and return any matches? Here's one attempt to list the ...
6
votes
3answers
833 views

What methodologies are useful when reverse-engineering malware / shellcode?

Whilst I'm familiar with reverse engineering techniques from a technical standpoint, I've never found a good methodology for approaching and dissecting malware / shellcode. I've found hundreds of ...
6
votes
2answers
246 views

Where can I find good resources on reversing web malware?

I am wondering where I can find a good site with resources on reversing web malware like javascript, flash, html5, and any other stuff that is designed to attack the clients. Does anyone have any ...
5
votes
2answers
2k views

How would I go about rebuilding the IAT of a packed executable?

When executables are packed with a tool such as UPX, the real code and data sections are encrypted or obfuscated, then loaded into memory using an injected decrypter stub. This makes static analysis ...
5
votes
2answers
675 views

Any MITM tool for forcing weak SSL cipher suite?

Let's say I'm trying to reverse engineering communctions between an Android app and a web server uing HTTPS. At beginning, I tried to do MITM using webmitm and a fake cert. But the app failed to ...
4
votes
5answers
5k views

Reverse engineering (decompiling) an .exe file in OSX

I am a complete newby in the reverse engineering world, and being able to decompile .exe files in my OSX is being a pain. Does anybody know a good decompiler of .exe for OSX, or any hint about where ...
4
votes
1answer
258 views

Reverse Engineering for .rtf files

I've received lately a .rtf attachment on my work email from an untrusted email account. I suspect the attacker is exploiting "Microsoft Security Bulletin MS12-029" vulnerability. What are the ...
4
votes
2answers
96 views

Securing an appliance

Scenario: We are in the position to offer a local appliance to run a version of our proprietary software, which is normally provided as SaaS. Question: What steps can be taken to mitigate trivial ...
3
votes
2answers
722 views

Are there any dangers in exposing git sha1 commit hashes?

For a non-public repository, are there any potential security concerns in sharing git commit hashes? For example, when I post a git-related stackoverflow question that involves git commits from ...
3
votes
1answer
905 views

Reverse-engineering password salts

Lets set out a scenario, a database has been dumped and all the passwords are hashed. You notice that some users seemed to have signed up twice and have the same hash. You run these hashes through ...
3
votes
2answers
105 views

What are ways I can analyze malware in an infected machine, not just clean it?

I often run into infected devices in my environment and would like to learn more about the specific infections that have gotten in. What are the best tools and techniques I could use to do this? I ...
3
votes
1answer
202 views

Recover file using Java RanNum Gen + Key

EDIT: Here is some more background. I am basically trying to reproduce this the method outlined here I have been able to hit everything up until the paragraph regarding the decrypting of the data file ...
3
votes
1answer
527 views

How to debug/reverse engineer java applets?

I need to analyze a java application (a .jar file) for a war game. I know java can be decompiled, but the coder apparently did a lot of obfuscation to prevent the reverse engineers from understanding ...
2
votes
1answer
2k views

where is the pe loader in windows?

I have read that the pe loader is responsible for loading executable images from disk. When and where is the control flow exactly transferred to the loader? The pe format is well documented but there ...
2
votes
1answer
217 views

Reverse Engineer this basic Hash using known answer?

Little background: I forgot one of my CCTV accounts password, so used the admin account to create a new one. However I can't access the old one as it's not possible to change a user account password, ...
2
votes
2answers
183 views

Decrypting TLS Traffic

Context: I want to reverse engineer a protocol in place for the Nintendo 3DS. The implementation however, uses TLS, which makes it difficult to reverse engineer. I'm currently able to sniff packets ...
2
votes
2answers
1k views

Finding out whether a website uses unsalted MD5 for password hashing

I'm working on a project where websites are analyzed and rated according to password security (factors like min/max password length, alphabet size and more are then calculated into a score). A great ...
2
votes
1answer
584 views

Examples for practicing reverse engineering/disassembly of win32 .executables

I remember back in the day, there used to be a website where users would post hackits in the form of win32 exes for users to crack. Usually the goal was to defeat some sort of DRM, such as a nag ...
2
votes
1answer
628 views

What tricks can be used to prevent debugging?

What tricks can be used to prevent or hinder debugging? Examples: IsDebuggerPresent API on Windows Exception handlers used for program flow. GetTickCount / rdtsc checks. Are there any good ...
2
votes
1answer
2k views

Expected cost and time frame for black box pen testing?

I work for a major publicly traded company and we need some external black box pen testing done on a Win32 executable. This exe is used in a large client server infrastructure and is a central piece ...
2
votes
1answer
373 views

How to reverse engineer w32/malware!gemini?

How would you go about reverse engineering malware W32/Malware!Gemini. Recently I found it installed on my computer and would like to trace where the data is being sent.
2
votes
1answer
771 views

Difference Between Binary Exploitation and Reverse Engineering?

I am a beginner in Reverse Engineering and am trying to improve my skill by participating in any CTF's I can and solving CrackMe's. I am trying to find out why Binary Exploitation and Reverse ...
2
votes
1answer
120 views

Eavesdropping a communication between a local application and the network

After some digging on the Internet, I've been unable to find a satisfying solution for my curiosity... Here's the thing : using a shell script, I've been able to obtain a list of IP addresses ...
2
votes
1answer
302 views

Identifying strange Perl CGI script

Recently, while looking at some Perl CGI files, I came across this. I am not familiar enough with Perl to know exactly what it means, but I did attempt to base64 decode the string to no effect. Can ...
2
votes
1answer
290 views

Good tools for reverse engineering colaboratively? [closed]

Does anybody know a good set of tools for doing reverse engineering of binaries in a collaborative way?. My original idea is to disassemble a binary, allowing to add information about functions, ...
2
votes
1answer
180 views

How is the file overlay read by an exe/virus?

According to what I know ,Overlay is the part of PE file that is not covered by the PE header and therefore isn't part of the virtual image in the Loaded PE. My question is if the overlay is not ...
2
votes
1answer
1k views

Extract SquashFS filesystem with shsq magic number [closed]

for a few days I was trying to extract the filesystem of a router firmware. Checking the image that the vendor provides I can see a SquashFS flag on it: DECIMAL HEX DESCRIPTION ...
1
vote
2answers
469 views

Is exploit researching different from penetration testing

I'm confused by some terminology - reverse engineering seems to me to be pretty similar to exploit researching. I mean if you can reverse one program probably you will be able to find a vulnerability, ...
1
vote
3answers
5k views

Is it possible to get the encryption key when you have the plaintext?

I have a question about SHA256. I know that this algorithm was used to encrypt a text, which I have. I also have the encrypted version of this text. My question is, can I somehow get to the encryption ...
1
vote
2answers
890 views

how to make software reverse engineering difficult

In software reverse engineering, we use a dissembler, a debugger, and a code patcher. OllyDbg includes all. One of the differences between actual execution of a program and debugging through using ...
1
vote
1answer
108 views

Java applet authenticity problem

I implemented an applet in java to authenticate users at my website by the usage of MIFARE cards and everything is working good. However I am concerned about the applet's authenticity, in other words, ...
1
vote
3answers
3k views

Are Citrix Netscalers vulnerable to shellshock bash command?

My enterprise environment is "protected" with reverse proxies, how safe am I?
1
vote
1answer
1k views

Explain the Heartbleed Python code [closed]

first post here so be gentle please! I understand the Heartbleed vulnerability concept, and I have a general grasp of Python. I'm struggling to understand the PoC Python code though, so was after a ...
1
vote
1answer
48 views

How Secure is my Application?

I have created a little application in .NET that serves as a loader for my other applications. Essentially, when opened, this app will get a list of available applications, and when an option is ...
1
vote
1answer
77 views

Why is there a path to a .pdb file in an exe I am trying to reverse?

My query is ,if I'm seeing a .pdb path in a exe(VC++) what conclusion can I draw from it.Why does the exe have these paths and does it have significance in malware analysis? eg ...
1
vote
1answer
169 views

Knowing Input&Output, How to determine encode method and the passkey that was used in encoding?

I've looked on this site and on SE. but I couldn't get a handle on this. Is there a way to find what type of encoding (and/or encode key) is being used? For example, I am testing a web ...