79
votes
Accepted
Can software passwords be bypassed by reverse engineering?
In short, yes, you can modify the executable, use a debugger, etc. to alter the logic of the code being executed.
But, that may not be enough.
To use your example of ".zip passwords", password ...
- 8,834
58
votes
Can I rely on these GitHub repository files?
Compilation is not a directly verifiable deterministic process across compiler versions, library versions, operating systems, or a number of other different variables. The only way to verify is to ...
- 135k
50
votes
Accepted
I feel like it's impossible to learn reverse engineering
So let me preface this with "I'm not implying you're a child"
Often when I teach kids about CIS and they hear what I do for a living, the first question is
"How do I hack?"
I'll tell you the same ...
- 1,451
49
votes
Accepted
Identifying the author(s) of a piece of malware
There are a number of different techniques, depending on the skill level of the malware author:
Embedded metadata - compiled programs can contain details about their authors. This is most commonly ...
- 27.4k
43
votes
Is there a way to prevent someone from making his own client app for my webservice?
This would be impossible. It is fundamental for your app to contain all the instructions necessary to use your API. Anyone with enough skill and time will be able to extract these secrets and create ...
- 391
43
votes
Accepted
What is the difference between Ghidra and Ida?
This is largely subjective, but:
Ghidra is free and open-source on GitHub, including the decompiler. IDA is very expensive, particularly when you start adding the decompiler licenses.
IDA supports ...
- 135k
42
votes
Can software passwords be bypassed by reverse engineering?
Well your perception of .zip passwords is not accurate. The approach, also used by many other programs is to always run a decryption algorithm and obtain a result, before program even reaches the "...
- 1,192
27
votes
Protecting firmware .bin from reverse engineering
@Marcus is completely correct about using encryption, and how the key has to be stored somewhere safe and possibly used in conjunction with secure boot. As far as tools go, there are many symmetric ...
- 12.7k
26
votes
Identifying the author(s) of a piece of malware
Matthew's answer was excellent. There are a few other ways as well.
Not a whole lot of malware authors are all that bright. For example, you can open a lot of executables in notepad and look for ...
- 22.6k
25
votes
Is there a way to prevent someone from making his own client app for my webservice?
It’s pretty easy and straightforward to create one’s own client regardless of whether REST or SOAP is used, as long as your Existing Client is available for everyone in the Play Store. Just capture ...
- 2,357
22
votes
Accepted
Can I rely on these GitHub repository files?
Polynomial tells you what may happen, and how to solve it. Here I will illustrate it:
I ran both binaries through strings and diffed them. That enough shows some completely harmless differences, in ...
- 336
21
votes
Can software passwords be bypassed by reverse engineering?
Yes and No.
Since no one has yet come up with a real life (non-computer-related) example, I'll try here:
Imagine trying to board a flight. You need a boarding pass, or the security guys will not let ...
- 933
19
votes
Does analysing Malicious code in gdb pose a security risk?
It certainly does. gdb will not isolate the process at all and will merely give you some control over it to understand what it does.
To do that kind of analysis, you should resort to a fully ...
- 1,969
18
votes
Protecting firmware .bin from reverse engineering
What you want is impossible; there's no "tool" that can do that.
When you encrypt your file, and then only someone in ownership of the key can get the contents – that's the point of ...
- 5,928
17
votes
Can software passwords be bypassed by reverse engineering?
Sure, software can do whatever you program it to do.
As a trivial example, if I was provided a Python program that checked for a password:
password = raw_input('Enter your password: ')
if password !=...
- 9,432
17
votes
Is there a way to prevent someone from making his own client app for my webservice?
From a security perspective, no, there's no way to do this. No matter how much obfuscation you put on the code and protocols, the fact is that the code to access the API and the network traffic ...
- 1,766
13
votes
What is the difference between Ghidra and Ida?
edit 2020-04-07: The Ghidra Book is scheduled to be released in July 2020. Currently only the first 8 chapters are available in the form of an early access PDF.
This question is better suited for ...
- 1,289
12
votes
Does GHIDRA have a debugger?
Edit: As the question is a little unclear there might be a misunderstanding. From my point of view there are 2 possible answers:
GHIDRA does not offer a debugger for other binaries currently. (It is ...
11
votes
I feel like it's impossible to learn reverse engineering
Reverse engineering is fun. I use IDA once every other week, so I am not an expert in the field but do it often enough. If you want to understand reverse engineering you need to know how to engineer ...
- 3,002
9
votes
Accepted
Viewing the stack
Getting a dump of memory the simple way
You can simply send your vulnerable process a SIGSEGV (kill -SEGV pid) and, if coredump is allowed (ulimit -c unlimited), you gonna get a nice core dump file ...
- 764
9
votes
Accepted
Malware sandbox detection
Start with this guide -- https://github.com/hfiref0x/VBoxHardenedLoader -- it's incredibly up-to date in terms of making a VirtualBox guest VM more-difficult to detect, including techniques valid in ...
- 19k
8
votes
Accepted
How to legally blog about Windows internals
Windows is actually quite open about how their operating system constructs work together in the overall system. In fact there are multiple books written to become familiar with Windows Internals, ...
- 12.4k
8
votes
Accepted
How to reverse engineer WannaCry?
Check out reverseengineering.SE for all your RE questions.
The name of the tool being used is Hiew.
From WannaCry — Links to Lazarus Group:
Some code in WannaCry (9c7c7149387a1c79679a87dd1ba755bc) ...
- 1,289
8
votes
Accepted
Does Java anti-decompiler software really work as claimed?
No, these do not work in the way claimed. They do not and cannot prevent reverse engineering and decompiling. The most they can possibly do is obfuscate Java to make it more difficult to understand, ...
- 66.5k
7
votes
Accepted
A code protector claims that it "ensures it is physically impossible to run code without a serial number" is this a scam?
So their market is protecting your app from the prying eyes of reverse engineers. Myself, I find that page a little too fluffy, and a little too scant on details. I certainly wouldn't buy their ...
- 58.8k
7
votes
Accepted
How could a publicly available stream cipher (RC4) be kept secret so long?
Couldn't someone just reverse-engineer the code and get the source?
Yes. That's exactly what happened in 1994:
From the Wikipedia entry:
RC4 was initially a trade secret, but in September 1994 a ...
- 14.8k
7
votes
Avoid unauthorized updating of online leaderboard php/sql
I disagree that it is impossible.
Depending on the form of your game it might be possible to apply the following scheme:
During the game, record the starting state, including seeds to RNGs and all ...
- 446
7
votes
What assembly should I learn?
My advice would be to first learn MIPS to wrap your head around how exactly heap and stack and OS calls work and then move on to x86 since you want to focus on developing malware for Windows.
EDIT: ...
- 512
6
votes
Accepted
Implications of Intel's SGX extension for malware detection and white hat reverse engineering
It is very unlikely that malware authors will be able to SGX. In fact it is very unlikely that most people will be able to use SGX. This is because Intel has implemented strong cryptographic DRM on ...
6
votes
Avoid unauthorized updating of online leaderboard php/sql
No, this is impossible.
You are relying on the client to provide accurate data. But you can not do that, because the client is outside of your control. It runs on the users hardware, which means that ...
- 49.3k
Only top scored, non community-wiki answers of a minimum length are eligible