Questions tagged [reverse-engineering]

Reverse engineering is the process of discovering the technological principles of a human made device, object or system through analysis of its structure, function and operation.

Filter by
Sorted by
Tagged with
6
votes
3answers
1k views

Why Youtube, or any other Google services use account binded authorization key plain in the url?

in the past I expirmented with Google available api tools, like the Drive and Youtube api's. The way it works is after you purchase a deveopler account, you are granted to many of Google services ...
0
votes
2answers
160 views

Where to find current, live botnet executable clients

I've been able to find readily available botnet source code online however I'm currently working on my university research project and require access to an actual botnet client which encompases DGA's (...
1
vote
2answers
746 views

Read memory of a java application

I need some starter advice here. Never done Java reverse engineering before, but I needed to somehow read the memory of a running desktop java application. The process communicates with an external ...
0
votes
1answer
174 views

What tools exist to crack, disable, and undo the effects of a malicious Linux binary? [closed]

I'm a network Penetration Tester and I'm trying to learn how to crack binaries. As an exercise, I've spent two days trying to crack a Linux binary that was supposedly designed to be cracked. ...
3
votes
1answer
2k views

Heap Overflow - unlink() technique exploitation on x86_64 (64 bit)

Trying to exploit this sample vulnerable program: /* Heap overflow vulnerable program. */ #include <stdlib.h> #include <string.h> int main( int argc, char * argv[] ) { char * ...
1
vote
1answer
252 views

Is it possible to protect your software and similar from being cracked? [duplicate]

With reverse engineering, you can disassemble, edit and do a lot more. This is probably used for cracking software in order to get the full versions and avoid using actual money. I do not really ...
4
votes
1answer
113 views

SSH access during manufacturing

What are security pros and cons if we have to enable SSH access during the manufacturing of the device (i.e. Fire Alarm Control Panel)? It is a manufacturer requirement. SSH access will be disabled ...
8
votes
1answer
609 views

Exploitation: EIP refuse to jump to the stack although it's executable

I wrote a program in C that is exploitable to BOF. TL;DR - My payload (NOP-sled + shellcode + return address) overrides EIP but I can't set EIP to point to the address of my payload, although I ...
10
votes
1answer
364 views

How to legally blog about Windows internals

In the field of malware analysis and reverse engineering, many job postings call for familiarity with the PE file format, Windows internals, etc. However, Microsoft presumably doesn't want people ...
0
votes
2answers
1k views

Buffer Overflow: Advice on exploiting

int play() { int a; int b; char buffer[010]; a = 0x41414141; b = 0x42424242; if (write(STDOUT_FILENO, "For a moment, nothing happened. Then, after a second or so, nothing ...
0
votes
2answers
116 views

Forcing a black box to register a ssl cerificate

I have in my home a proprietary device, which I took an interest to see what it does over the network. I first determined his Ip on my network, and the port used to pass http/s requests, then arp ...
40
votes
11answers
15k views

Can software passwords be bypassed by reverse engineering?

Let's say, on any software (that is installed on Client-Side OS), is it possible, to alter the software in such way (i.e. Zip Passwords) so for incorrect input it redirected to correct "result&...
0
votes
1answer
273 views

Is possible to apply an inverse function to remove a compiled object?

I create a watermark with photoshop like this To make this watermark I use a software functions of a software (for example photoshop). Functions is implement like set instructions (my variables) a, ...
2
votes
1answer
504 views

Interactive shell not opening

I'm performing a buffer overflow attack on a binary and I managed to get proper return address and execute my shell code. It successfully ran the shell code. But I'm not getting a shell. When I type ...
14
votes
2answers
4k views

Viewing the stack

I recently started learning about buffer overflows and how they work. Someone shared a binary to practice on (in a vm, don't worry). I've been feeding strings to the socket that the binary opens, and ...
2
votes
1answer
2k views

Exploit VS Reverse Engineering VS PenTest [closed]

To start let me say that I'm trying to find my way in infoSec...I wanna know which path to follow. My background is basic database CRUD programming (HTML Php, JavaScirpt, Java etc...) I just read an ...
1
vote
0answers
460 views

Mitigating Memory Dump and Analyze of an Application

I have used Frida and Fridump for Memory Dump & Strings Dump on a mobile device which I installed an app for testing. In the strings.txt file I have extracted using the mentioned above tools, I'm ...
1
vote
0answers
142 views

“Random” key generated every second, how can I tell how it is created? [closed]

Long story short, I have a program that generates 32 character keys. These keys change every second so I assume they are time based. Some of these keys are as follows: 8é 03]TyjzyQ;µ°g'Ôñ"KL2ûä*ª ...
1
vote
0answers
121 views

Volatility Plug-ins to investigate packed exe files

I am using volatility for malware analysis. I have got a process in my memory image that is packed by malware using UPX packer. Malfind plugin doesn't show injected code for it also. How can i use ...
0
votes
1answer
75 views

Why a pdf is opened when I click a url when the url specifies its a zip ?Is this link trustworthy?

So basically the href of the anchor tag is something like hxxtp://www.xxxx/xx.zip and the anchor tag text visible to user is something like xxxx.pdf ,when user clicks it Mozilla opens it as a .pdf but ...
1
vote
3answers
24k views

How to set reverse tcp connection when doing pentesting in VMs?

msfconsole is a cool opensource pentesting tool from metasploit. Once the exploit is valid, we can set payload to the victim. For persistent connection, we may need meterpreter. But we often test ...
0
votes
2answers
239 views

What is actually happening in the background when using such things as airmon? [closed]

Firstly: Apologies if this is not the relevant place to ask this, if not then some direction would be good (thank you). I have been interested in Information Security for some years now, but have ...
1
vote
1answer
403 views

Starting off with Malware Analysis

I am starting off with malware reversing/analysis for the first time. I have been going through many resources on the internet. Some of them being pretty awesome and helpful, like SANS resources, ...
3
votes
3answers
2k views

Found DSA and RSA private keys hard-coded in a file during penetration testing. How to use them for SSH authentication?

We are performing a penetration test as part of a study where the hardware unit listens for connection over FTP, SSH, and Telnet. All of these are password-protected. The hardware unit must first be ...
0
votes
1answer
331 views

Why use XOR or OR operator for “bypass” a conditional jump

I'm currently working on a challenge on root me but had to read the solution on internet because I couldn't progress anymore. I read this article which talk about the challenge I'm currently working ...
2
votes
2answers
913 views

Disk encryption with OTP to protect source code

We have to ship a hard- and software prototype to a customer for a first field test. The software is just not ready (protected - too much Python code) for distribution without the possibility, that ...
-1
votes
1answer
176 views

Decompiling folders inside a jar file [closed]

I am in possession of a jar file that I have reason to believe has a RAT inside. I downloaded it inside of a virtual machine with jad installed and began to attempt to look at the source. I found that ...
11
votes
1answer
2k views

Does analysing Malicious code in gdb pose a security risk?

I have encountered a Malicious Shell-Code & i have ported the shellcode into a compatible C Code which can run the shellcode, i compiled it using gcc -fno-stack-protector -z execstack shellcode.c ...
4
votes
1answer
5k views

Which file encryption algorithm is used by Synology's Cloud Sync feature? [closed]

I'm trying to find out which encryption method is used by a piece of software I use, viz. the 'Cloud Sync' feature of Synology's DSM 6.0 running on a Synology NAS. (Background. This Cloud Sync ...
0
votes
1answer
373 views

Possible to take hash from know result and algorithm?

I am trying to build a casino site in PHP where users can play roulette. I found this algorithm that I want to use to "roll" numbers: <?php $secret = '...
5
votes
2answers
319 views

Revising Phising Email & it's payload… did I do this right?

Recently my company got a widespread phishing email sent to them, thankfully no one clicked the link (which is great!) Since I'm a student and a current intern working in IT Security I wanted to see ...
1
vote
1answer
590 views

How can I find the size of an array just from compiled C program?

I'm playing around with buffer and heap overflow vulnerabilities, and it is all fine to exploit stuff when you have the source code and can see all the variables, their sizes and values, etc. But, ...
1
vote
1answer
119 views

Polymorphic Analysis

I'm a beginner at malware analysis. For my research studies, I have to identify polymorphic malware based from experiments. I would like to know if there are any guides showing how to analyze the code ...
6
votes
3answers
3k views

Disabling android application debug mode as a security practice

There's a security practice which says you should not publish your android application with debug mode enabled. While an attacker can use apktool to decompile your application, enable the debug flag ...
1
vote
2answers
672 views

Reverse Engineering - Countermeasures [closed]

I'm new to information security but I'm learning about reverse engineering. I read here about countermeasures to make reverse engineering hard. Does code signing protect the code from reverse ...
2
votes
1answer
2k views

Is using IsBadReadPtr and IsBadWritePtr considered to be insecure?

I am auditing (reverse engineering) an x86 C++ application without source code. Static analysis revealed that the application is using the IsBadReadPtr and IsBadWritePtr Win32 functions in almost ALL ...
2
votes
2answers
262 views

Detecting code removal reverse engineering

I'm writing some native code in Android. Although it's tough to reverse engineer native codes as compared to Java, still this is possible. I'd want a condition wherein if someone removes or comments ...
5
votes
1answer
574 views

A code protector claims that it “ensures it is physically impossible to run code without a serial number” is this a scam?

VMProtect Software (found at http://vmpsoft.com/) claims that it: "allows the generation and verification of serial numbers. Both manual and automatic generation are supported. Serial numbers can be ...
29
votes
2answers
4k views

Identifying the author(s) of a piece of malware

When a new piece of malware appears, people can try to determine where it comes from, and who its authors could be. How do security experts attempt to identify the authors of a new publicly disclosed ...
5
votes
5answers
680 views

Avoid unauthorized updating of online leaderboard php/sql [duplicate]

I am developing an offline web app (game) for android using cordova (phonegap). The leaderboard of the same is maintained online in my server. Currently this is how the leaderboard is updated Step 1)...
2
votes
1answer
717 views

Is it possible to extract and re-use the API of a mobile banking app [closed]

I am aware of the basic techniques used to reverse engineer and extract meaningful information in order to re-use an applications API. I am not fully adept with the advanced techniques however. Is ...
3
votes
2answers
486 views

Implications of Intel's SGX extension for malware detection and white hat reverse engineering

Intel's new SGX extension is concerning. It allows the programmer to create enclaves in their program where the data is encrypted until it is used. This is apparently supposed to be used for cloud ...
9
votes
1answer
394 views

Computer Virus Phylogenies algorithms - pseudocode?

I've collected a large number of "Web Shell by oRb" (a.k.a. "FilesMan" backdoor, a.k.a. antichat backdoor) files by running a WordPress honeypot, and searching pastebin. The code in the variants is ...
1
vote
0answers
411 views

National ID analysis and generator?

A National ID in my country consists of 14 digits: CYYMMDDXXZZZZ1C1 Where: C refers to the century - 2 for those born between 1900 and 1999, 3 for those born between 2000 to 2099 YYMMDD - birth ...
3
votes
3answers
153 views

Decrypt SSL Connections established by a Host I have adminsitrative privileges on

I want to decrypt a SSL connection that is established by an unknown binary file on a Windows 7 Computer. This binary doesn't exist on any other computer on our network and establishes SSL encrypted ...
4
votes
1answer
412 views

How could a publicly available stream cipher (RC4) be kept secret so long?

I'm reading about the cryptographic function called RC4. Apparently, its method was kept secret from 1987 until 1994 despite being available to the public for licensing and use. How did it stay ...
0
votes
1answer
2k views

Certificate pinning in android apps

I have found a whitepaper on bypassing ssl pinning. If this is true, how can we securely implement certificate pinning in android apps? Is there any other workarounds possible other than certificate ...
2
votes
0answers
86 views

Problem when disassembling 16-bit binary one instruction at the time

I am currently disassembling a binary that enters vm86 mode, so 32-bit binary in 16-bit mode. While IDA fails to do that correctly, I took the initiative to do it by myself. Problem is, I very often ...
-4
votes
1answer
415 views

What are the best tools available in order to reverse engineer a communication protocol? [closed]

What are the best tools available in order to reverse engineer a communication protocol?
-4
votes
3answers
277 views

Reverse Engineer and Exploits researching [closed]

Can some one give me a start point for finding exploits in software and reverse engineering? I need some kind of a book or a site... I have background with programming with high and low level such as ...