Skip to main content
The 2024 Developer Survey results are live! See the results
79 votes
Accepted

Can software passwords be bypassed by reverse engineering?

In short, yes, you can modify the executable, use a debugger, etc. to alter the logic of the code being executed. But, that may not be enough. To use your example of ".zip passwords", password ...
Alexander O'Mara's user avatar
58 votes

Can I rely on these GitHub repository files?

Compilation is not a directly verifiable deterministic process across compiler versions, library versions, operating systems, or a number of other different variables. The only way to verify is to ...
Polynomial's user avatar
  • 135k
51 votes
Accepted

I feel like it's impossible to learn reverse engineering

So let me preface this with "I'm not implying you're a child" Often when I teach kids about CIS and they hear what I do for a living, the first question is "How do I hack?" I'll tell you the same ...
DotNetRussell's user avatar
45 votes
Accepted

What is the difference between Ghidra and Ida?

This is largely subjective, but: Ghidra is free and open-source on GitHub, including the decompiler. IDA is very expensive, particularly when you start adding the decompiler licenses. IDA supports ...
Polynomial's user avatar
  • 135k
42 votes

Can software passwords be bypassed by reverse engineering?

Well your perception of .zip passwords is not accurate. The approach, also used by many other programs is to always run a decryption algorithm and obtain a result, before program even reaches the "...
kubanczyk's user avatar
  • 1,192
42 votes

Is there a way to prevent someone from making his own client app for my webservice?

This would be impossible. It is fundamental for your app to contain all the instructions necessary to use your API. Anyone with enough skill and time will be able to extract these secrets and create ...
Justin Gerhardt's user avatar
27 votes

Protecting firmware .bin from reverse engineering

@Marcus is completely correct about using encryption, and how the key has to be stored somewhere safe and possibly used in conjunction with secure boot. As far as tools go, there are many symmetric ...
multithr3at3d's user avatar
25 votes

Is there a way to prevent someone from making his own client app for my webservice?

It’s pretty easy and straightforward to create one’s own client regardless of whether REST or SOAP is used, as long as your Existing Client is available for everyone in the Play Store. Just capture ...
JOW's user avatar
  • 2,337
22 votes
Accepted

Can I rely on these GitHub repository files?

Polynomial tells you what may happen, and how to solve it. Here I will illustrate it: I ran both binaries through strings and diffed them. That enough shows some completely harmless differences, in ...
Davidmh's user avatar
  • 336
21 votes

Can software passwords be bypassed by reverse engineering?

Yes and No. Since no one has yet come up with a real life (non-computer-related) example, I'll try here: Imagine trying to board a flight. You need a boarding pass, or the security guys will not let ...
kevin's user avatar
  • 933
19 votes

Does analysing Malicious code in gdb pose a security risk?

It certainly does. gdb will not isolate the process at all and will merely give you some control over it to understand what it does. To do that kind of analysis, you should resort to a fully ...
Julie Pelletier's user avatar
18 votes

Protecting firmware .bin from reverse engineering

What you want is impossible; there's no "tool" that can do that. When you encrypt your file, and then only someone in ownership of the key can get the contents – that's the point of ...
Marcus Müller's user avatar
17 votes

Can software passwords be bypassed by reverse engineering?

Sure, software can do whatever you program it to do. As a trivial example, if I was provided a Python program that checked for a password: password = raw_input('Enter your password: ') if password !=...
Xiong Chiamiov's user avatar
17 votes

Is there a way to prevent someone from making his own client app for my webservice?

From a security perspective, no, there's no way to do this. No matter how much obfuscation you put on the code and protocols, the fact is that the code to access the API and the network traffic ...
micheal65536's user avatar
  • 1,766
13 votes

What is the difference between Ghidra and Ida?

edit 2020-04-07: The Ghidra Book is scheduled to be released in July 2020. Currently only the first 8 chapters are available in the form of an early access PDF. This question is better suited for ...
julian's user avatar
  • 1,299
12 votes

I feel like it's impossible to learn reverse engineering

Reverse engineering is fun. I use IDA once every other week, so I am not an expert in the field but do it often enough. If you want to understand reverse engineering you need to know how to engineer ...
Joe M's user avatar
  • 3,012
12 votes

Does GHIDRA have a debugger?

Edit: As the question is a little unclear there might be a misunderstanding. From my point of view there are 2 possible answers: GHIDRA does not offer a debugger for other binaries currently. (It is ...
Euphrasius von der Hummelwiese's user avatar
9 votes
Accepted

Viewing the stack

Getting a dump of memory the simple way You can simply send your vulnerable process a SIGSEGV (kill -SEGV pid) and, if coredump is allowed (ulimit -c unlimited), you gonna get a nice core dump file ...
binarym's user avatar
  • 784
9 votes
Accepted

Malware sandbox detection

Start with this guide -- https://github.com/hfiref0x/VBoxHardenedLoader -- it's incredibly up-to date in terms of making a VirtualBox guest VM more-difficult to detect, including techniques valid in ...
atdre's user avatar
  • 19.1k
8 votes
Accepted

How to legally blog about Windows internals

Windows is actually quite open about how their operating system constructs work together in the overall system. In fact there are multiple books written to become familiar with Windows Internals, ...
RoraΖ's user avatar
  • 12.5k
8 votes
Accepted

How to reverse engineer WannaCry?

Check out reverseengineering.SE for all your RE questions. The name of the tool being used is Hiew. From WannaCry — Links to Lazarus Group: Some code in WannaCry (9c7c7149387a1c79679a87dd1ba755bc) ...
julian's user avatar
  • 1,299
8 votes
Accepted

Does Java anti-decompiler software really work as claimed?

No, these do not work in the way claimed. They do not and cannot prevent reverse engineering and decompiling. The most they can possibly do is obfuscate Java to make it more difficult to understand, ...
forest's user avatar
  • 67k
7 votes

What assembly should I learn?

My advice would be to first learn MIPS to wrap your head around how exactly heap and stack and OS calls work and then move on to x86 since you want to focus on developing malware for Windows. EDIT: ...
Gillian's user avatar
  • 512
7 votes

Why does my stack contain the return address to __libc_csu_init after main is initialised?

Your main function contains pointer to __libc_csu_init just before its return pointer, because that's how stack frame works; before entering a function, caller pushes a stack frame pointer and a ...
Daniel 0xdbeef Zalega's user avatar
6 votes

Disk encryption with OTP to protect source code

Send one of your engineers with the laptop. Rationale: If it's important enough to send a laptop, it's important enough to send a person There will be no problems caused by ad-hoc encryption and lock-...
Law29's user avatar
  • 731
6 votes
Accepted

What makes malware like Stuxnet or Duqu so advanced?

0days are usually fairly expensive. You have to consider the manpower required to find them. Then to find a specific sequence of 0days required to hop into a specific framework is closer to a ...
user148650's user avatar
6 votes
Accepted

How do security experts benefit from reverse-engineering?

What do you do in most reverse engineering challenges in CTF's (if you're not just pulling out passwords with strings) You analyze the logic of the program in it's normal behavior. Analyze which ...
Nomad's user avatar
  • 2,399
6 votes
Accepted

How to analyze malware to find out where keylogger sent data?

If you are not an expert in this skill, there are still some automated malware analysis tools that you can use to get some information from the files. Sandboxes can be a very useful tool, and Cuckoo ...
schroeder's user avatar
  • 131k
6 votes

Protecting firmware .bin from reverse engineering

In order to prevent reverse-engineering of their Management Engine, Intel used: An obscure CPU architecture (not their own) an exotic compression algorithm with hardware-backed dictionary a less-...
fraxinus's user avatar
  • 3,568
6 votes
Accepted

Is possible to reverse engineer a AES encryption of a known file format?

No. You're describing a known-plaintext attack, which AES is resistant to, just like every other cipher worth using today is.
Joseph Sible-Reinstate Monica's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible