Search Results
| Search type | Search syntax |
|---|---|
| Tags | [tag] |
| Exact | "words here" |
| Author |
user:1234 user:me (yours) |
| Score |
score:3 (3+) score:0 (none) |
| Answers |
answers:3 (3+) answers:0 (none) isaccepted:yes hasaccepted:no inquestion:1234 |
| Views | views:250 |
| Code | code:"if (foo != bar)" |
| Sections |
title:apples body:"apples oranges" |
| URL | url:"*.example.com" |
| Saves | in:saves |
| Status |
closed:yes duplicate:no migrated:no wiki:no |
| Types |
is:question is:answer |
| Exclude |
-[tag] -apples |
| For more details on advanced search visit our help page | |
Results tagged with reverse-engineering
Search options answers only
not deleted
user 5400
Reverse engineering is the process of discovering the technological principles of a human made device, object or system through analysis of its structure, function and operation.
2
votes
how to get address of PE section to jump in while backdooring PE binary
There are three addressing concepts you need here. RVAs, VAs, and offsets.
Relative virtual addresses (RVAs) are addresses into virtual memory. They are configured via the PE's header. If you look at …
- 136k
45
votes
Accepted
What is the difference between Ghidra and Ida?
This is largely subjective, but:
Ghidra is free and open-source on GitHub, including the decompiler. IDA is very expensive, particularly when you start adding the decompiler licenses.
IDA supports so …
- 136k
22
votes
Accepted
Where is the PE loader in Windows?
To answer your question, I need to cover the full description of how a new process created.
There's a great description of this in Chapter 5 of Windows Internals 6th Edition Part 1 (ch. 5 being avail …
- 136k
63
votes
Why does malware periodically check google.com
Most likely, it's just trying to check if there's a working internet connection.
The malware authors assume that:
Google (or other Alexa Top-1M sites) will be up 99.999% of the time.
Traffic going …
- 136k
1
vote
Accepted
How Secure is my Application?
From what you described, it's not secure at all, for a bunch of reasons. The top two being:
You're downloading data over HTTP. Even if AES provides confidentiality, it doesn't provide message authen …
- 136k
58
votes
Can I rely on these GitHub repository files?
Compilation is not a directly verifiable deterministic process across compiler versions, library versions, operating systems, or a number of other different variables. The only way to verify is to per …
- 136k
1
vote
What can I do with reverse engineering
Based on the phrasing of your question, I suspect you might be conflating reverse engineering with exploit development.
Reverse engineering, in the context of software, is taking some implementation o …
- 136k
2
votes
Some introductory reverse engineering help on finding a string
In the "Dump" section at the bottom of x64dbg / x32dbg, you can right click and select "Find Pattern". In there you can search for ASCII, Unicode (UTF-16), or UTF-8 encoded strings in memory.
Cheat En …
- 136k