Questions tagged [reverse-engineering]

Reverse engineering is the process of discovering the technological principles of a human made device, object or system through analysis of its structure, function and operation.

Filter by
Sorted by
Tagged with
1
vote
1answer
101 views

Are emulators isolated from the host for malware testing?

I know that virtualization is different from emulation; I was wondering if emulation is isolated from its host and any destruction on it will not affect the host as if it were a virtual machine. I ...
-1
votes
1answer
75 views

Security technologies that implements security through “organic-like” obscurity? [closed]

Are there any advanced security technologies, for example, establishing a secured connection, which first require authentication based on security through organic-like changing obscurity of secrecy? I'...
50
votes
6answers
9k views

How valuable is secrecy of an algorithm?

On the surface, the inadvisability of security through obscurity is directly at odds with the concept of shared secrets (i.e. "passwords"). Which is to say: if secrecy around passwords is valuable, ...
0
votes
1answer
218 views

Overwrite return address in C

It's about a CTF Challenge. I'm trying to execute a buffer overflow attack on a C program. The code is : #include<stdio.h> #include<string.h> #include<stdlib.h> #include <sys/...
1
vote
1answer
119 views

Polymorphic Analysis

I'm a beginner at malware analysis. For my research studies, I have to identify polymorphic malware based from experiments. I would like to know if there are any guides showing how to analyze the code ...
1
vote
3answers
1k views

Intercept HTTP Traffic of an android app?

I was trying to test and intercept traffic from an app developed on Rhodes open source framework, I setup a proxy with burp, and of course I have installed burp certificate on my device hence I can ...
6
votes
7answers
18k views

Reverse engineering (decompiling) an hackme challenge .exe file in OSX

I am a complete newbie in the reverse engineering world, and being able to decompile .exe files in my OSX is being a pain. Does anybody know a good decompiler of .exe for OSX, or any hint about where ...
13
votes
2answers
2k views

Malware sandbox detection

I started some reverse engineering exercises using Ollydbg, IDA Pro and other tools like Sysinternals suite, etc. Some of these exercises are about malware. I downloaded some different malware from ...
1
vote
1answer
59 views

How to identify user created vs. external functions in disassembly

I'm new to assembly and have been playing around with it. While i was analyzing malware, I realised that there are multiple functions named sub_xxxxxx. How does one determine if this sub_xxxxxx is ...
2
votes
2answers
751 views

Problem with Reverse Engineering GVM light, possibly encoding issue

So I bought this GVM-560AS LED photography light on Amazon. It is a really good light for the job; but to control it remotely you have to download a really dodgy APK from the GVM website, a package ...
3
votes
1answer
94 views

Running a brief asm script inline for dynamic analysis

Is there any good reason not to run a brief unknown (30 line) assembly script inline in a usermode c program for dynamic analysis directly on my laptop? There's only one system call to time, and at ...
1
vote
1answer
68 views

Is there a way to tell what the file does before opening it?

You have just noticed that an unknown executable file has been downloaded to your machine. Is there a way to tell what the file does before opening it?
9
votes
4answers
20k views

Does GHIDRA have a debugger?

Does GHIDRA have a debugger attached for dynamic analysis of application?
0
votes
1answer
86 views

How to start pentesting/reverse engineering/cracking a software on Linux? (Docker based) [closed]

TL:DR; What are good learning resources for security testing a software which runs with Docker on Ubuntu. I am in junior position at this company, and they figured it would be good if I just test ...
40
votes
11answers
15k views

Can software passwords be bypassed by reverse engineering?

Let's say, on any software (that is installed on Client-Side OS), is it possible, to alter the software in such way (i.e. Zip Passwords) so for incorrect input it redirected to correct "result&...
1
vote
1answer
90 views

How to protect conditional 'if' in Android from reverse enginneering

I recently downloaded one apk from a custom apkstore from my country. You can download the app for free but you need to pay to use some functionalities. I cracked the app jumping over all the ...
2
votes
0answers
28 views

How to Get full PLT Entry of a function and not the offset?

I am trying to leak libc's base address by first leaking the address of gets(). However, using Pwntools to get the PLT and GOT (and pretty much anything) entries only gives me their offsets as ...
1
vote
1answer
52 views

ROP on MIPS Doesn't Land Where Calculated

I am working on exploiting an application on MIPS to further my knowledge of ROP chaining. The library I am trying to build a ROP chain is libuClibc-0.9.30.3.so. I found a gadget that I want to use ...
0
votes
1answer
205 views

What is source of bad characters exist in buffer overflows

I'm new to exploit development and while watching a tutorial I came across the topic of "Bad character identification". I'm referring to the process of sending all possible characters to the ...
0
votes
0answers
86 views

Repackaging Mobile app which resists repackaging

I tried repackaging an Android app but after installation, when I launch that app, the app crashes immediately. This is the exception I am getting when I decompile this application using apktool and ...
1
vote
1answer
200 views

Easy way to hardware lock an exe file in windows

Hi I want an easy way to hardware lock an exe file to a specific system so that when a user copies that file to another system it does not open.
1
vote
1answer
99 views

How are games and software executables injected with custom code & without breaking offset?

Introduction – Context Everyone has seen so called "Injectors" or "Cracks" for certain programs & games at some point in their life. These applications inject their own code ...
0
votes
1answer
77 views

what are the best counter measures against reverse engineering of firmware? [closed]

How can I best prevent, that critical commandos (e.g. open garage door) from an IoT device are being reverse engineered from the firmware? Is the following list complete / do you spot any errors? Any ...
8
votes
2answers
3k views

Are there any dangers in exposing git sha1 commit hashes?

For a non-public repository, are there any potential security concerns in sharing git commit hashes? For example, when I post a git-related stackoverflow question that involves git commits from ...
2
votes
3answers
4k views

Protecting firmware .bin from reverse engineering

I would like to protect my .bin ( squash fs ) file after compiling process in order to avoid reverse engineering techniques ( i.e. binwalk could simply unsquash my .bin firmware and see all the file ...
0
votes
0answers
135 views

Bypass ASLR in buffer overflow

Iam new in buffer overflow and i have some questions : Is all dll files in windows are loaded at memory or some of them only , If some of them , Who tell windows to load this and leave this How an ....
0
votes
0answers
42 views

Mnemonic Seed Phrase Generation For Private Key Truncation

The below code block is capable of generating a mnemonic seed phrase. If I want to generate a mnemonic seed for a private key, is it then correctly understood that I should input the private key as ...
0
votes
2answers
64 views

How to find vulnerabilities in a program by looking at it's source code [closed]

Hello I have recently started learning Reverse Engineering. I often hear that it's much easier to find vulnerabilities in a program by looking at it's source code, but i don't know how to find them or ...
1
vote
1answer
97 views

Does the DICOM file header gets lost when transferred over the network?

I am currently investigating the PEDICOM vulnerability CVE-2019-11687 where I am trying to reassemble the P-DATA DICOM fragments from a PCAP. Since the vulnerability takes advantage of writing bytes ...
0
votes
1answer
54 views

Static detection of PE

I'm doing in static analysis of PE file. Can PE file have two or more executable sections? How can we detect whether it is injected or not?
1
vote
0answers
56 views

static analysis for identifying backdoors in PE [duplicate]

I am doing research in identifying backdoors in Windows .exe files. Currently I found some methods to detect them: String search in .exe Find reference .dll and win32 API calls using import table ...
0
votes
0answers
166 views

John the Ripper Obtain Password from Hash

John the Ripper 1. Ran ./pdf2john.pl /home/desktop/1.pdf > /home/desktop/1.txt (Hash inside 1.txt) 2. Ran ./john /home/desktop/1.txt Output: Loaded 1 password hash (PDF [MD5 SHA2 RC4/AES 32/64]) No ...
22
votes
2answers
22k views

What is the difference between Ghidra and Ida?

Is there a comparison between Ghidra and Ida? Are there any specific features and functionality that Ghidra while Ida doesn't? Is there a good source (most preferably book) that explain Ghidra in ...
6
votes
3answers
3k views

Disabling android application debug mode as a security practice

There's a security practice which says you should not publish your android application with debug mode enabled. While an attacker can use apktool to decompile your application, enable the debug flag ...
2
votes
1answer
131 views

Access to foreign memory address

Modern operating systems like Windows 10 isolate memory addresses for processes so how is it possible that Cheat Engine can get these addressed and change their values? At this forum it has already ...
1
vote
1answer
62 views

Securing media uploading to the cloud from reverse engineering

I own an RPG multiplayer game written in Java, where players can fight each other in the game. Recently I planned to invent a new feature, where the last 15 seconds of your fight and the "knockout" ...
8
votes
3answers
9k views

Where is the PE loader in Windows?

I have read that the PE loader is responsible for loading executable images from disk. When and where is the control flow exactly transferred to the loader? The PE format is well documented but there ...
1
vote
2answers
2k views

Is there some way to protect apk file from being decompiled?

I'd like to know if there's something to help with that that isn't over complicated as I'd like to protect an Android application against that at least a bit. I'd like to make clear that I'm talking ...
0
votes
0answers
80 views

How to decrypt a rocksdb file from Android?

I have collected an encrypted RocksDB file from an Android application. By reverse engineering the mobile application I have also collected the encryption key. However, for the life of me I cannot ...
0
votes
1answer
1k views

Strange HTTP request from binaryedge.ninja

I found the following strange HTTP request apparently emanating from binaryedge.ninja: min-li-ustx-12-13-65991-x-prod.binaryedge.ninja - - [05/Jan/2020:07:18:48 -0500] "GET / HTTP/1.0" 302 212 "-" "-...
0
votes
1answer
192 views

.NET application protection technique against cracking

I'm trying to protect my software against cracking. Protection against cracking is crucial before listing the product on market. Info about the software: Built using .NET C# (Framework 4.5.2) ...
0
votes
3answers
713 views

ret2libc - why need 4 bytes of garbage

So I started to learn reverse engineering, and I came across the ret2libc exploit. I tried to understand how it works and I got a bit confused. They say that when you return to the address of system ...
1
vote
0answers
106 views

How to analyze a USB device of having possibly malicious capabilities?

So I recently ordered a chinese external USB card and I would like to find out whether it has some hidden functionality, which might become malicious. It has buttons integrated in it so Linux using ...
0
votes
1answer
216 views

Reverse engineering and buffer overflows: zero to hero [closed]

When I do CTFs, I can usually cope well with and understanding everything pretty much apart from buffer overflows, binary exploitation and reverse engineering Almost to the point that I would ...
2
votes
0answers
685 views

Ghidra Load Linux Headers [closed]

I'm trying to reverse engineer a linux kernel module (kernel version 4.19). Ghidra does recognize correctly all function names such as: open, misc_register etc, but it cannot determinate their exact ...
1
vote
0answers
153 views

Passively read key from process memory without invoking kernel (windows 10)

I have a process that loads into memory like any other process. It contains a special key. Our goal is to read this key inside memory...or while it is in transit across the data bus from cpu. The ...
0
votes
1answer
221 views

Exploiting vulnerabilities in the C code

I'm preparing for an introductory information security examination in university and this is one of the examination questions on Secure Programming. In such questions, I would usually catch for ...
0
votes
1answer
110 views

Should I complie software after making all the variable and function names “1-2 character”? [duplicate]

In JavaScript, it seems common for the official release of the code to use only single-character variable and function names (of course, after converting the original code which uses clearer names) in ...
0
votes
1answer
80 views

how to extract binaries from SOHO routers and other devices

I read this excellent article about vulnerability research into a DLINK wireless router. The researcher explains clearly the coding mistake that leads to the vulnerability. He obviously reverse-...
4
votes
1answer
1k views

Program detecting sandboxie present - How to prevent?

I am having issues with a particular game, detecting the presence of the games being run inside sandboxie (An application for running programs inside a sandbox) with the goal of running multiple ...

1
2 3 4 5