reverse-engineering

Why does initializing a string in a function doesn't work like int while debugging

瘦欲@ 提交于 2019-12-06 15:47:35
So I tried debugging some simple C programs today ; First one being int main(){ int a ,b ; return 0 ; } Which when de-compiled gave me push ebp mov ebp,esp sub esp,008h because I need to have 8 bytes to store a and b in the current stack frame since they are local variable ! But when I try the same with Strings say int main() { char greeting[12] = "Pwnit2Ownit"; return 0; } Which when de-compiled gave me push ebp mov ebp,esp sub esp,0DCh 0DCh is 220 , But since the string is only 12 bytes long shouldn't the sub esp,0DCh be sub esp,00ch instead ? And can anyone share some links on how the

ANN for decompiler?

大憨熊 提交于 2019-12-06 12:25:01
问题 Has there ever been any attempts at utilizing artificial neural networks in decompilation? It would be nice if it was possible to provide the trimmed semantics of source along with the code in to a neural network so it could learn the connection between the two. I assume this would likely lose it's effectiveness when there is optimizations and maybe work better for high level languages too but I'm interested in hearing any attempts anyone has had at this. 回答1: I'm assuming you mean

Graph visualization of existing .NET code [closed]

喜你入骨 提交于 2019-12-06 11:38:04
问题 Closed. This question is off-topic. It is not currently accepting answers. Want to improve this question? Update the question so it's on-topic for Stack Overflow. Closed last year . I've seen that VS 2010 Ultimate can generate model graph from existing code. But VS 2010 Ultimate version costs 11K US$, way too much for my budget. Is there any good alternative to do graph visualization of .NET code? 回答1: NDepend comes with a dependency graph coupled with a dependency matrix. You can try NDepend

Can i crack usb security dongle?

青春壹個敷衍的年華 提交于 2019-12-06 11:32:37
I have to develop a plugin for a program that uses dongle to activate.Just wondering can i crack the key of the usb or something else? I'm sure you can , but you might be running afoul of the various legislation regarding the act of reverse engineering content protection systems. I am, of course, referring to the American DCMA statues. In any event, as pure thought experiment, I might try the following: Clone the USB firmware image, and load it into a virtual USB port As you say, crack the key and the USB interface, and short-circuit the check in a virtual USB device. Locate the part of the

Can I combine all the sections “Objdump -S -d elf-file” generate into a re-assemble capable file?

烂漫一生 提交于 2019-12-06 10:59:35
问题 THe elf file is static linked and currently the objdump's output is something like: Disassembly of section: .init: xxxxxx Disassembly of section: .plt: xxxxxx Disassembly of section: .text: xxxxxx basically what I want to achieve is "elf-file -(disassemble by objdump)-> assemble file --(re-compile)--> same functionality " I don't need the re-compiled binary has the binary content same as the original one, only same functionality is enough. After a quick search, basically the answer is no ,

How to extract Virtual Table informations from a shared library?

雨燕双飞 提交于 2019-12-06 09:54:57
I'm implementing a performance analysis tool. One thing that I'm doing is to estimate the cost of a function call. In order to do that, I need to know if a given function is virtual in a shared library. For that, I have access to the shared library assembly. I have also a call graph of the execution. I cannot make anything during the execution, the analysis has to be done after the execution using the information I can obtain from the call graph and the shared libraries. The only way I've thought of is to extract the vtable from the library and look if my function is in the vtable, but I didn

How Self & Total time is calculated having Google Chrome's devtools profile report (cpuprofile file)

孤街浪徒 提交于 2019-12-06 09:44:04
I'm writing tool to parse and extract some data from cpuprofile file (file produced when I save profile report) and I'm having some troubles with precision of Self & Total times calculations. So, time depends on the value from field hitCount , but. When hitCount is small (<300) the coefficient between hitCount and Self time ~1.033. But as hitCount grows, coefficient also grows. So, when hitCount=3585, k is 1.057. When hitCount=7265: k=1.066. Currently I'm using 1.035 as coefficient, I tried to minimize error on my sample data. But I'm not happy with approximation. I'm not familiar with

How to use proguard in cordova android App

痞子三分冷 提交于 2019-12-06 07:50:01
I have a finished cordova project and i want to use proguard inorder to prevent others from reverse engineering the APK.But i have trouble doing this. In http://developer.android.com/tools/help/proguard.html It says that "When you create an Android project, a proguard.cfg file is automatically generated in the root directory of the project. " But i cannot find a such file. So how do i apply proguard to my app? Thank you Queen You need to uncomment below lines from your project.properties file To enable ProGuard to shrink and obfuscate your code, uncomment this (available properties: sdk.dir,

FreeLibraryAndExitThread crashes program when unloading injected DLL

孤者浪人 提交于 2019-12-06 06:17:46
I am writing a DLL that gets injected into a game in order to play around with some reverse engineering. For a while I was able to successfully inject, eject and reinject as I made changes to the program. I'm using FreeLibraryAndExitThread to unload. After adding XInput to the program so I could catch user input, the game crashes with an access violation when I call FreeLibraryAndExitThread . Going from this post , I'm guessing that using XInput is leaving something 'live' in the program when I go to unload, and that's what's causing the crash. I'm honestly at a loss as to how to fix this.

Finding a function in a disassembly

有些话、适合烂在心里 提交于 2019-12-06 05:51:30
问题 I'm busy following a tutorial where the author uses DUMPBIN to list exports, and OllyDbg to get the assembly code for an exported function. How would I find the functions code in the complete disassemly, given that the export tables RVA's don't correspond to real addresses in the disassembly. 回答1: A RVA is a relocatable virtual address. To find the real address in the process space you need to know the base address where the module was loaded in the process. Add that base address to the RVA