dza + reverse-engineering   132

Reverse Engineering — Make OTX works in OS X Mavericks with Xcode 5
# wrong: It's like this.
sudo ln -s /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/otool /Applications/Xcode.app/Contents/Developer/usr/bin/

# LINK IS OUTDATED, USE ABOVE ^
otx  mavericks  howto  tutorial  guide  xcode  debugging  asm  assembly  reverse-engineering  reverse  engineering 
december 2013 by dza
0xd4d / de4dot — Bitbucket
Supposedly the only one that can't be deobfuscated by common tools.
reverse-engineering  obfuscation  decompile  decompiler  CLR  csharp  net  windows  dotnet 
october 2013 by dza
Confuser - Home
C# code obfuscation, encryption, packing ...

Seems to be THE tool for the job.
confuser  csharp  reverse-engineering  reverse  obfuscator  pack  packer  cil  dbugger  decompiler  decompilation  encrypt  encryption  security  dev 
april 2013 by dza
Software archaeology
asmDIFF | An x86 binary assembler search tool

asmDiff is an binary assembly search, diff and disassembly tool. It supports Windows PE (exe/dll) and Linux ELF binary format compiled for x86 and x68_64 architectures. It is particular useful when searching for asm functions, instructions or memory pointers in a patched, updated or otherwise modified binary. Try out the live demo and read the paper below.

Note: asmDIFF is still closed source as long as we do not know how to proceed with it. Feel free to contact us on questions, suggestions, or licensing request. However a fully useable win32 version is included in mmBBQ 3.0.0 and upwards.

Quick start:

upload two binaries files. (exe/dll/elf)
$> asmdiff search <ADDR> -o <OLDFILE> -n <NEWFILE>
$> asmdiff diff -o /usr/bin/asmdiff -n /usr/bin/asmdiff
assembly  reverse-engineering  reverse  security  diff  instruction  instructions  asm 
march 2013 by dza
Blizzhackers • Index page
One of the most epic Reverse-Engineering gaming sites on the internet :) for one of the most secure online platforms, powered by one of the most feared ban-hammers (Warden).
game  gaming  reverse-engineering  reverse  howto  tutorial  guide  warcraft  starcraft  world  of  1  2  3  wc3  sc2  sc  wc  wow  warden  hook  hooks  d3  diablo  blizzard 
march 2013 by dza
OpenRCE (OpenRCE)
sulley

A pure-python fully automated and unattended fuzzing framework.

Last updated 5 months ago

Python
76
32

paimei

A reverse engineering framework written in Python.

Last updated a year ago

Python
60
25

pydbg

A pure-python win32 debugger interface.

Last updated a year ago
openrce  reverse-engineering  reverse  pydbg  sulley  paimei  github 
march 2013 by dza
wxHexEditor - a Free Hex Editor / Disk Editor for Huge Files or Devices on Linux, Windows and MacOSX
Looks like a decent free Hex editor with interesting features such as:
* Disassembly instructions
* Conversion
* and more!

From the creator of the custom SAMSUNG TV firmware SamyGo
hex  edit  editor  win  linux  mac  macosx  win32  disassembly  reverse-engineering  reverse  software  windows 
march 2013 by dza
Bios Mods -The Best BIOS Update and Modification Source
* CPU Support Upgrades
* Unlocking of OC, and hidden menus
* HDD limit Upgrades
* Wifi/WWAN Replacement, Whitelist (mini PCI-e replacement)
Be sure to check the forum!
bios  mods  ami  award  phoenix  AFUDOS  PHLASH  insyde  wlan  wifi  howto  tutorials  guide  reverse-engineering  reverse 
march 2013 by dza
zynamics.com - BinDiff
Comparing two executables to learn from already cracked programs in a graphed assembly output for education, GREAT!
asm  reverse-engineering  reverse  compare  difference  diff  comparing  crack  cracking  binary 
march 2013 by dza
Reverse Engineering 1 - YouTube
Basic understanding of Reverse-Engineering and ASM instructions. Great examples, great voice, long, thorough.
reverse-engineering  beginner  asm  assembly  reverse  basic 
february 2013 by dza
winapiexec - RaMMicHaeL's home page
Run Win32 API functions directly from the command-line.

Pretty handy for reversing huh?
win32  winapi  windows  api  exec  reverse-engineering  reverse 
february 2013 by dza
winitor
PeStudio helps you to discover many security relevant details about any application and library without starting them, like:

whether Applications are embedded in an application
whether Registry files are embedded in an application
whether PDF files are embedded in an application
whether CAB files are embedded in an application
whether Anonymous functions are exported
whether Obsolete functions are imported
whether Data Execution Prevention (DEP) will be used
whether Address Space Layout Randomization (ASLR) is used
whether Structured Exception Handling (SEH) is used
whether Unused bytes (Caves) are available
whether Structured Storage is used
whether The file is obfuscated (encrypted, compressed)
and many more details...
pestudio  reverse-engineering  reverse  tool  tools  download 
february 2013 by dza
Linux system debugging super tutorial
Debugging with GDB, strace, ltrace and lsof on slow processes ...
howto  tutorial  guide  dev  lsof  linux  strace  ltrace  profile  profiling  reverse  reverse-engineering 
december 2012 by dza
How main() is executed on Linux LG #84
Starting

The question is simple: how does linux execute my main()?
Through this document, I'll use the following simple C program to illustrate how it works. It's called "simple.c"

main()
{
return(0);
}

Build

gcc -o simple simple.c

What's in the executable?

To see what's in the executable, let's use a tool "objdump"

objdump -f simple

simple: file format elf32-i386
architecture: i386, flags 0x00000112:
EXEC_P, HAS_SYMS, D_PAGED
start address 0x080482d0

The output gives us some critical information about the executable.
First of all, the file is "ELF32" format. Second of all, the start address is "0x080482d0"
asm  assembly  reverse-engineering  reverse  linux  objdump  gcc  howto  tutorial  guide  dev 
september 2012 by dza
Tavis Ormandy - Executable Patching with GDB
Some really professional advice, from an Opera dev- I stumbled upon this guy searching for some Opera advice at another time :)

He looks very talented and writes a good article.
gdb  reverse  reverse-engineering  patch  patching  debug  debugging  assembly  asm  nasm_assemble  gdbinit  assemble 
may 2012 by dza
Binary File Descriptor library - Wikipedia, the free encyclopedia
The Binary File Descriptor library (BFD) is the GNU Project's main mechanism for the portable manipulation of object files in a variety of formats. As of 2003, it supports approximately 50 file formats for some 25 processor architectures.
bfd  binary  file  descriptor  library  gdb  reverse  reverse-engineering  assembly  asm 
may 2012 by dza
Beej's Quick Guide to GDB
Compiling to use a debugger
More Information
License
Starting gdb and getting to main()
Breakpoints
Stepping Around
Examining Variables
Misc Stuff
Stack Manipulation
Additional Stepping Methods
Jumping to an Arbitrary Section of Code
Changing Variables and Values at Runtime
Hardware Watchpoints
Attach to a Running Process
Using Coredumps for Postmortem Analysis
Window Functions
Display Registers and Assembly
Writing a Front-End
Quick Reference Cheat Sheet
gdb  break  breakpoint  breakpoints  step  stepping  debug  debugging  asm  assembly  reverse  reverse-engineering  coredump  coredumps  stack  stacks  variable  variables  values  watch  watchpoints  attach  window  function  functions  register  registers  cheatsheet  cheatsheets 
may 2012 by dza
dirtyJOE - Java Overall Editor - Homepage of binary java class file editor
dirty
>JOE<
Java Overall Editor

For Reverse-Engineering java .class files ..
reverse  reverse-engineering  dirtyjoe  class  java  dev  python 
april 2012 by dza
Assembly - SkullSecurity
Fundamentals -- Information about C
Tools
Registers
Simple Instructions
Example 1 -- SC CDKey Initial Verification
Example 2 -- SC CDKey Shuffle
Example 2b -- SC CDKey Final Decode
The Stack
Stack Example
Functions
Example 3 -- Storm.dll SStrChr
Assembly Summary

Machine Code
Example 4 -- Smashing the Stack
Cracking a Game
Example 5 -- Cracking a game
Example 6 -- Writing a keygen
.dll Injection and Patching
Memory Searching
Example 7 -- Writing a cheat for Starcraft (1.05)
Example 7 Step 1 -- Displaying Messages
Example 7 Step 1b -- Above, w/ func ptrs
Example 7 Final
Example 8 -- Getting IX86.dll files
16-bit Assembly
Example 9 -- Keygen for a 16-bit game
Example 10 -- Writing a loader
skullsecurity  asm  assembly  assembler  starcraft  cdkey  cd-key  stack  crack  cracking  keygen  keygenning  reverse  reverse-engineering  cheat  16-bit  loader 
april 2012 by dza
Academic Underground: The Examiner
Makes it easier to read OBJDUMP by adding comments.
objdump  examiner  debug  debugging  linux  asm  assembly  reverse  reverse-engineering 
april 2012 by dza
gdb CHEATSHEET
===== CHEATSHEET =====
execution: gdb --write --nx --quiet
--write (enable overwriting the current running executable with modifications)
--nx
--quiet (less verbose)

set write (from inside GDB, enable writing into executable and core files- CAUTION: watch out so you don't make segfaults in core libraries !!)

stepi/si
Execute one machine instruction, then stop and return to the debugger. It enters shared libraries functions also, so don't use it normally unless this is what you intend.

next
Execute one machine instruction, then stop and return to the debugger. It doesn't enter shared libraries functions.

nexti/ni
Execute one machine instruction, then stop and return to the debugger. It doesn't enter shared libraries functions.

You can go forward as many instructions you want with "ni 2" (in this case 2)

layout asm (enable assembly line-by-line splitview, like ollydbg or other disassemblers)

break *0x00000000 (break at exact address)
break gtk_message_dialog_new (break at exact function)

x/x 0x00000000 (show value @ location)
set {int} 0x00000000 = 0x00000000 (set bytes @ location)
info registers

display/$pc - display current line ($pc == current line asm)
display/$eax - display register $eax
.. and so on !

# LLDB

register read # read registers
register r -f bin eflags # read eflags (along with ZF, in binary)
memory write 0x02ae4 74 # write opcodes to memory
di -f # disassemble --frame - disassemble current frame

# invert zeroflag from 0 to 1
expr -f bin -- $eflags|0x40
# invert zeroflag from 1 to 0
expr -f bin -- $eflags&~0x40
# ^ because 0x40 in hex (calculator) is equal to the 6th (64 in decimal) place.
# we could do
# invert zeroflag from 0 to 1
expr -f bin -- $eflags|64
# invert zeroflag from 1 to 0
expr -f bin -- $eflags&~64
# instead to signify that we invert the "64" bits (6th place).
gdb  reference  cheatsheet  debug  debugging  reverse  reverse-engineering  asm  assembly  debugger  !gdb  zf  zero  flag  zeroflag  from notes
april 2012 by dza
w4kfu's bl0g
Google Translate (mixed french/english)

Diablo II securom v4 tutorial (French)
Red Alert: Tiberian Sun safedisc aka c-dilla (English)
Version 41 of SafeDisc 1 (Tutorial)
Safedisc 2 (Tutorial)
Prioxer Trojan/backdoor analysis (Tutorial)
"binary-auditing.com" unpackme (Tutorial)

Great blog.
howto  tutorial  guide  reverse  reverse-engineering  malware  virus  analysis  french  crack  cracking  safedisc  c-dilla  cdilla 
march 2012 by dza
Binary world for binary people :)
Little crackme/keygenme and network security / hacking
exploit  exploits  hack  hacking  security  network  networking  reverse  reverse-engineering 
march 2012 by dza
Recurity Labs
Basic to advanced ASM (haven't read it)
howto  tutorial  guide  security  asm  assembly  reverse  reverse-engineering 
march 2012 by dza
ScrontSoft - Includes
DirectX 8 assembly tutorials / examples ..
win32  windows  directx  d3d  d3d8  dx8  directx8  asm  assembly  reverse-engineering  reverse 
march 2012 by dza
« earlier      
per page:    204080120160

related tags

!gdb  0xed  16-bit  76service  a  activex  AFUDOS  american  ami  analysis  android  anti-debug  anti-debugging  api  apihooks  apple  aquaticprime  archived  ARM  as  ascii  ASLR  asm  asm.js  assemble  assembler  assembly  attach  attaching  avd  award  backdoor  basic  beginner  bfd  biew  binary  bios  bitcoin  blizzard  book  books  boot  booting  bpx  break  breakpoint  breakpoints  bsd  buffer  c  c++  c-dilla  call  calls  carding  cc  cd-key  cdilla  cdkey  chat  chatting  cheat  cheatsheet  cheatsheets  checksum  cil  class  CLR  cocoa  code  commander  compare  comparing  compiler  compilers  compressor  compressors  confuser  connscan  connscan2  control  coredump  coredumps  CoreFoundation  CoreGraphics  cpp  crack  cracker  cracking  crackme  crackmes  cracks  crash  crc  creditcard  csharp  d3  d3d  d3d8  dalvik  date  datetime  dbg  dbugger  dead  death  debian  debug  debugger  debuggers  debugging  decompilation  decompile  decompiler  defcon  DEP  descriptor  dev  device  diablo  diablo3  diff  difference  directx  directx8  dirtyjoe  disassemble  disassembler  disassemblers  disassembling  disassembly  dotnet  download  download.this  dump  dumping  dx8  dynamic  ebook  edb  edit  editor  editors  eflags  elf  emu  emulator  encrypt  encryption  engineering  evan's  evans  examiner  exec  exploit  exploiting  exploits  file  file-analyzer  file-analyzers  FindWindow  firewall  firewalls  fishme  flag  foff  format  formats  forum  Foundation  french  fs_usage  function  functions  game  games  gaming  gcc  gdb  gdbinit  GDT  gendump  getlocaltime  getsystemtime  getsystemtimeasfiletime  GetTitleBarInfo  GetWindowPosition  github  google  Gozi  graf  guide  hack  hacker  hacking  hash  header  headers  heap  help  hex  hivelist  hoff  hook  hooks  hover  HoverControl  howto  humor  ia-32  ia32  iii  immunity  impacket  inject  instruction  instructions  insyde  INt3  intel  interesting  IntPtr  java  javascript  jmp  jne  js  kartograph  kernel  key  keygen  keygenme  keygenmes  keygenning  keygens  keylog  keylogger  krobar  LDT  library  link  links  linux  lipo  lldb  lm  loader  lsof  ltrace  maas  mac  macosx  malfind  malware  maphack  market  mavericks  megatrends  memdump  memory  mode  mods  moonsols  nasm_assemble  native  net  network  networking  newbie  news  nm  ntfs  ntlm  obfuscation  obfuscator  obj-c  objc  objdump  objective-c  of  olly  ollydbg  onlinehashcrack  opcode  opcodes  openrce  opensourcedays  ophcrack  os  osd  osd13  osx  other  others  otool  otx  overflow  overflows  pack  packer  paimei  patch  patcher  patchers  patching  pbx  pcapy  peid  perl  pestudio  PHLASH  phoenix  php  pinvoke  play  Prinimalka  profile  profiling  programming  protected  protection  protections  protector  protectors  pslist  PT_DENY_ATTACH  public  pwdump  pydbg  python  qt  quickstart  radare  RAM  RC4  rce  re  readelf  real  RED  reddit  reference  register  registers  registration  reverse  reverse-engineering  reverseenginerring  reversing  ROP  russian  safedisc  sam  samsung  sc  sc2  security  segment  segments  SEH  SEHOP  serial  serials  service  SetControl  SetWindowLong  SetWindowLongPtr  SetWinEventHook  shadowcrew  shellcode  skullsecurity  smarttv  smashing  SnD  snowman  softice  software  stack  stacks  starcraft  steganography  step  stepping  stick  strace  sulley  supreme  symbol  symbols  syscall  syscalls  system  table  TDL  test  themida  time  timewaste  tool  toolkit  tools  trainer  trial  tsbx  tutorial  tutorials  tv  uefi  unicode  unix  unpacker  unpackers  unreal  usb  values  variable  variables  video  virtual  virus  vmmap  vol  vol.py  volshell  w32dasm  warcraft  warden  wargame  wargames  watch  watchpoints  wc  wc3  wdbg  wifi  wikibooks  win  win32  win32api  win32dd  winapi  window  windows  WinEventHook  WinEventProc  winpcap  wireless  wishlist  wlan  world  wow  WPM  x86  xbox  xcode  zero  zeroflag  zf 

Copy this bookmark:



description:


tags: