Questions tagged [reverse-engineering]

Reverse engineering is the process of discovering the technological principles of a human made device, object or system through analysis of its structure, function and operation.

Filter by
Sorted by
Tagged with
50
votes
6answers
9k views

How valuable is secrecy of an algorithm?

On the surface, the inadvisability of security through obscurity is directly at odds with the concept of shared secrets (i.e. "passwords"). Which is to say: if secrecy around passwords is valuable, ...
45
votes
15answers
11k views

Should we protect web application source code from being stolen by web hosts through obfuscation?

Is it worth to obfuscate a java web app source code so that the web host cannot make wrong use of the code or even steal your business? If so, how should this be dealt with? How should we obfuscate? ...
40
votes
11answers
15k views

Can software passwords be bypassed by reverse engineering?

Let's say, on any software (that is installed on Client-Side OS), is it possible, to alter the software in such way (i.e. Zip Passwords) so for incorrect input it redirected to correct "result&...
33
votes
5answers
2k views

Why would malware try to remove other malware?

Recently my php-based website got infected with malware (probably by a stolen ftp password). Basically, every 30 minutes a file frame_cleaner_php.php was uploaded, a HTTP-GET was done on it to execute ...
32
votes
4answers
6k views

Why does malware periodically check google.com

I'm looking at some malware PCAPs, e.g. http://malware-traffic-analysis.net/2014/05/27/index.html . One of the things I've been seeing frequently is requests to alexa top million sites (e.g. yandex, ...
31
votes
3answers
8k views

Why can't reverse engineering be automated?

I am still in college for a Computer Security degree and took my first assembly language based class last semester. We touched upon the subject of reverse engineering and why it is an important part ...
31
votes
8answers
8k views

Is there a way to prevent someone from making his own client app for my webservice? [duplicate]

Say I have a RESTful web service and a commercial Android app on the front end which is used to interact with it. I may use SSL so that the endpoints are not visible, but someone could still do some ...
31
votes
4answers
17k views

I feel like it's impossible to learn reverse engineering [closed]

I know how to use most of the tools in Kali like msfvenom and msfconsole and I can safely call myself a script kiddie. I learned the basics of C# and that helps me understand some of the things in C, ...
29
votes
2answers
4k views

Identifying the author(s) of a piece of malware

When a new piece of malware appears, people can try to determine where it comes from, and who its authors could be. How do security experts attempt to identify the authors of a new publicly disclosed ...
22
votes
2answers
23k views

What is the difference between Ghidra and Ida?

Is there a comparison between Ghidra and Ida? Are there any specific features and functionality that Ghidra while Ida doesn't? Is there a good source (most preferably book) that explain Ghidra in ...
21
votes
3answers
8k views

Can I rely on these GitHub repository files?

I recently found the GitHub repository https://github.com/userEn1gm4/HLuna, but after I cloned it I noted that the comparison between the file compiled (using g++) from source, HLuna.cxx, and the ...
20
votes
6answers
7k views

Becoming a malware analyst?

So, I'm currently 16 and am considering a career in IT when I finish school. The thing that has intrigued me the most while growing up is malware. I've come across it so often and have often had to ...
19
votes
2answers
14k views

Facebook API : App Secret - possible misuse

I've recently find out that by simple quick look into compiled code of one of our applications, you can get both App ID (API Key) and App Secret for Facebook API I suppose that we should really keep ...
18
votes
7answers
12k views

Any comprehensive solutions for binary code protection and anti-reverse-engineering? [closed]

Does anyone know of good products with comprehensive binary hardening and anti-reverse-engineering features? Or better, has anyone seen an independent review comparing products that perform these ...
18
votes
1answer
983 views

Skype opens base64-encoded JavaScript. What does it do?

I just came across a rather unusual problem, and I cannot figure out if it actually is a problem (or even security issue) or not. Upon opening Skype on MacOS, a popup window appears (multiple times, ...
14
votes
2answers
4k views

Viewing the stack

I recently started learning about buffer overflows and how they work. Someone shared a binary to practice on (in a vm, don't worry). I've been feeding strings to the socket that the binary opens, and ...
13
votes
4answers
4k views

Preventing reverse-engineering of client application

I have a web service which is used by a Flash client. Both the service and the Flash client is produced by me (read: my company). The Flash client communicates with the server over HTTPS. One of the ...
13
votes
2answers
2k views

Malware sandbox detection

I started some reverse engineering exercises using Ollydbg, IDA Pro and other tools like Sysinternals suite, etc. Some of these exercises are about malware. I downloaded some different malware from ...
12
votes
2answers
10k views

How would I go about rebuilding the IAT of a packed executable?

When executables are packed with a tool such as UPX, the real code and data sections are encrypted or obfuscated, then loaded into memory using an injected decrypter stub. This makes static analysis ...
11
votes
4answers
2k views

How can I audit which type of Block Mode encryption is being used when no source code is available?

Given that there are clear advantages to using some block modes of encryption over another, and I would like to ensure that all software used in the enterprise uses a certain "level" of security I'd ...
11
votes
3answers
11k views

Reverse engineering and Java

Is java class file or jar file is easy to reverse engineer? Because java generates a class file after compilation and not exe files. Is jar and class files are easy to decompile compare to c# and C++? ...
11
votes
1answer
2k views

Does analysing Malicious code in gdb pose a security risk?

I have encountered a Malicious Shell-Code & i have ported the shellcode into a compatible C Code which can run the shellcode, i compiled it using gcc -fno-stack-protector -z execstack shellcode.c ...
10
votes
4answers
7k views

How to harden an iPhone/Android app so it's tough to reverse-engineer it?

These are the following objectives I have in mind: Make the app hard to crack, as the binary will hold some secret tokens. If it still can be cracked, is there any way the app can tell someone or its ...
10
votes
1answer
2k views

What role does cryptography play in anti-piracy?

As a follow-up to Cipher for Product Registration, are there secure yet usable cryptographic standards/protocols for protecting software and data used by software? I'm interested in hardware and ...
10
votes
1answer
364 views

How to legally blog about Windows internals

In the field of malware analysis and reverse engineering, many job postings call for familiarity with the PE file format, Windows internals, etc. However, Microsoft presumably doesn't want people ...
9
votes
3answers
3k views

Vuln research: reverse engineering, debugging or fuzzing?

I wonder how hackers find vulnerabilities. If they use fuzzing, security engineers do it, and it's probably that security engineers (that work in a firm) have more resources than a group of hackers. ...
9
votes
4answers
20k views

Does GHIDRA have a debugger?

Does GHIDRA have a debugger attached for dynamic analysis of application?
9
votes
1answer
2k views

Any MITM tool for forcing weak SSL cipher suite?

Let's say I'm trying to reverse engineering communctions between an Android app and a web server uing HTTPS. At beginning, I tried to do MITM using webmitm and a fake cert. But the app failed to ...
9
votes
1answer
394 views

Computer Virus Phylogenies algorithms - pseudocode?

I've collected a large number of "Web Shell by oRb" (a.k.a. "FilesMan" backdoor, a.k.a. antichat backdoor) files by running a WordPress honeypot, and searching pastebin. The code in the variants is ...
8
votes
3answers
9k views

Where is the PE loader in Windows?

I have read that the PE loader is responsible for loading executable images from disk. When and where is the control flow exactly transferred to the loader? The PE format is well documented but there ...
8
votes
3answers
1k views

Global check of input/output of known hash functions

Is there a website, application, or script that will allow you to give an input/output for a hash function, run these against known functions, and return any matches? Here's one attempt to list the ...
8
votes
3answers
1k views

Is initializing variable to NULL or 0 or -1 a bad practice from security standpoint?

I'm trying to learn little bit about armoring application against reverse engineering. In one article I read that initializing variables to NULL or 0 or -1 is as secure (vs RE) as using common ...
8
votes
2answers
3k views

Are there any dangers in exposing git sha1 commit hashes?

For a non-public repository, are there any potential security concerns in sharing git commit hashes? For example, when I post a git-related stackoverflow question that involves git commits from ...
8
votes
2answers
368 views

Where can I find good resources on reversing web malware?

I am wondering where I can find a good site with resources on reversing web malware like javascript, flash, html5, and any other stuff that is designed to attack the clients. Does anyone have any ...
8
votes
1answer
609 views

Exploitation: EIP refuse to jump to the stack although it's executable

I wrote a program in C that is exploitable to BOF. TL;DR - My payload (NOP-sled + shellcode + return address) overrides EIP but I can't set EIP to point to the address of my payload, although I ...
8
votes
1answer
802 views

Protection against Android Reverse Engineering

I have been particularly trying to find the most effective measures to protect an apk from Reverse engineering and abusive use. While continuing my research I came across various top rated apps and ...
7
votes
2answers
2k views

What are ways I can analyze malware in an infected machine, not just clean it?

I often run into infected devices in my environment and would like to learn more about the specific infections that have gotten in. What are the best tools and techniques I could use to do this? I ...
6
votes
7answers
18k views

Reverse engineering (decompiling) an hackme challenge .exe file in OSX

I am a complete newbie in the reverse engineering world, and being able to decompile .exe files in my OSX is being a pain. Does anybody know a good decompiler of .exe for OSX, or any hint about where ...
6
votes
3answers
2k views

What methodologies are useful when reverse-engineering malware / shellcode?

Whilst I'm familiar with reverse engineering techniques from a technical standpoint, I've never found a good methodology for approaching and dissecting malware / shellcode. I've found hundreds of ...
6
votes
1answer
4k views

Reverse-engineering password salts

Lets set out a scenario, a database has been dumped and all the passwords are hashed. You notice that some users seemed to have signed up twice and have the same hash. You run these hashes through ...
6
votes
3answers
3k views

Disabling android application debug mode as a security practice

There's a security practice which says you should not publish your android application with debug mode enabled. While an attacker can use apktool to decompile your application, enable the debug flag ...
6
votes
3answers
1k views

Why Youtube, or any other Google services use account binded authorization key plain in the url?

in the past I expirmented with Google available api tools, like the Drive and Youtube api's. The way it works is after you purchase a deveopler account, you are granted to many of Google services ...
5
votes
5answers
680 views

Avoid unauthorized updating of online leaderboard php/sql [duplicate]

I am developing an offline web app (game) for android using cordova (phonegap). The leaderboard of the same is maintained online in my server. Currently this is how the leaderboard is updated Step 1)...
5
votes
1answer
2k views

How to reverse engineer WannaCry? [closed]

I was reading an article today about a Google researcher linking the WannaCry malware to the earlier malware Cantopee. I had two primary questions based on the contents of the article. What do the ...
5
votes
1answer
574 views

A code protector claims that it “ensures it is physically impossible to run code without a serial number” is this a scam?

VMProtect Software (found at http://vmpsoft.com/) claims that it: "allows the generation and verification of serial numbers. Both manual and automatic generation are supported. Serial numbers can be ...
5
votes
2answers
3k views

Finding out whether a website uses unsalted MD5 for password hashing

I'm working on a project where websites are analyzed and rated according to password security (factors like min/max password length, alphabet size and more are then calculated into a score). A great ...
5
votes
2answers
3k views

Preventing users from bypassing root/jailbreak detection measures

A pentest was made to our mobile app (Android and iOS version) and we received feedback stating that jailbreak/root detection was ineffective because it was relatively easy to reverse engineer the ...
5
votes
1answer
5k views

Difference Between Binary Exploitation and Reverse Engineering?

I am a beginner in Reverse Engineering and am trying to improve my skill by participating in any CTF's I can and solving CrackMe's. I am trying to find out why Binary Exploitation and Reverse ...
5
votes
2answers
319 views

Revising Phising Email & it's payload… did I do this right?

Recently my company got a widespread phishing email sent to them, thankfully no one clicked the link (which is great!) Since I'm a student and a current intern working in IT Security I wanted to see ...
4
votes
3answers
3k views

how to make software reverse engineering difficult

In software reverse engineering, we use a dissembler, a debugger, and a code patcher. OllyDbg includes all. One of the differences between actual execution of a program and debugging through using ...

1
2 3 4 5