Stack Exchange
log in sign up chat discuss faq users badges

Area 51 » Technology

definition commitment beta
251
followers

Reverse Engineering

Beta Q&A site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation.

This proposal is now in the Beta phase — example questions are locked!

51 Example Questions

active newest votes
up vote 22 down vote
What are the major challenges in the static analysis of binary executables?
added by 94c3 Jan 28 '13 at 15:42
link
5  
<comments removed> Please do not use comments to answer these questions. Comments are here to help improve the questions. This proposal is not part of the Q&A site, and the task at hand is to help define a future site. Thank you. – Robert Cartaino Jan 28 '13 at 16:26
1  
Doesn't this seem too open-ended and subjective, and therefore "not a good fit for our Q&A format"? – KenB Feb 19 '13 at 19:04
up vote 16 down vote
How to decompile an object file (.o) into C source code?
added by delete Jan 13 '13 at 21:42
link
4  
Might be better to be more explicit here, i.e. how to translate an object file back to source. In my mind this question is about decompilation and the limits thereof. – 94c3 Jan 28 '13 at 16:45
1  
The title of this question is not a question as it should be. Maybe "How do I convert an .o file back to C source code?" – Vegard Feb 5 '13 at 15:00
up vote 15 down vote
Are there public test suites available for testing a disassembler?
added by 94c3 Jan 28 '13 at 15:54
link
This question generated some interest on the reverse engineering subreddit: reddit.com/r/ReverseEngineering/comments/16hz9z/…. – 94c3 Jan 28 '13 at 16:02
up vote 13 down vote
What are the techniques disassemblers use to process a binary?
added by 94c3 Jan 28 '13 at 16:07
link
<comments removed> Please do not use comments to answer these questions. Comments are here to help improve the questions. This proposal is not part of the Q&A site, and the task at hand is to help define a future site. Thank you. – Robert Cartaino Jan 28 '13 at 16:24
up vote 13 down vote
What scriptable debuggers exist that are cross-platform, if any? Preference given to python-based implementations.
added by Jordan Jan 29 '13 at 6:19
link
up vote 12 down vote
I'm beginning my study of reverse engineering topics and would like book recommendations -- what should I read first to better my skills?
added by Jordan Jan 29 '13 at 6:21
link
4  
This seems like a bad question for a couple reasons. It is not possible to give an exact answer. It will simply be a wiki page. Additionally, as time passes, all answers will become outdated as new techniques emerge. – samoz Feb 1 '13 at 17:30
3  
I agree with samoz that these questions don't have an exact answer and tend to get out of date. With that said though, I have found a lot of the "book" questions on SO to be really helpful resources even though they are eventually closed and locked. – Simucal Feb 4 '13 at 14:05
up vote 11 down vote
I can't figure out this snippet of highly optimized, compiler-generated assembly code; what does it do? What optimization is it?
added by Syzygy Feb 2 '13 at 2:31
link
1  
I am a little bit concerned about the prospect of users (perhaps especially new users) dumping a large block of ASM and saying "reverse this for me plz kthxbye". – KenB Feb 19 '13 at 19:06
Maybe, what could I use to tell me? Otherwise, @KenB is right and we could be in trouble. – delete Feb 20 '13 at 9:31
There should be requirements for those dumps. Like origin, size and what is this person looking for. – 2df Feb 20 '13 at 23:45
up vote 11 down vote
What methods exist to extract firmware from an embedded device to enable reverse engineering?
added by nopnopgoose Feb 2 '13 at 20:27
link
up vote 11 down vote
What is the best way to inject functionality into an existing executable?
added by bushing Feb 4 '13 at 3:59
link
up vote 11 down vote
What is the best way of reverse-engineering this device driver?
added by bushing Feb 4 '13 at 4:03
link
up vote 11 down vote
How can I locate all of the crypto keys embedded within this executable?
added by bushing Feb 4 '13 at 4:13
link
up vote 10 down vote
What is the relationship between data flow and control flow?
added by 94c3 Jan 28 '13 at 15:51
link
<comments removed> Please do not use comments to answer these questions. Comments are here to help improve the questions. This proposal is not part of the Q&A site, and the task at hand is to help define a future site. Thank you. – Robert Cartaino Jan 28 '13 at 16:25
up vote 10 down vote
How are virtualization obfuscators different than other types of obfuscation?
added by 94c3 Jan 28 '13 at 15:58
link
<comments removed> Please do not use comments to answer these questions. Comments are here to help improve the questions. This proposal is not part of the Q&A site, and the task at hand is to help define a future site. Thank you. – Robert Cartaino Jan 28 '13 at 16:25
up vote 10 down vote
What are the best practice methods for documenting research into reverse engineering of software packages and their file formats?
added by Ross Spencer Jan 28 '13 at 16:22
link
up vote 10 down vote
How can I go about unpacking a UPX binary?
added by samoz Jan 28 '13 at 19:08
link
up vote 10 down vote
What disassembly libraries exist that handle multiple architectures using a uniform C or C++ API?
added by jix Feb 1 '13 at 21:04
link
up vote 10 down vote
Have you ever seen this form of obfuscation before? Any ideas on how I go about breaking it?
added by Syzygy Feb 3 '13 at 21:47
link
up vote 10 down vote
What is the state of the art in automation of vulnerability analysis? What can realistically be achieved with today's publicly-available technology?
added by Syzygy Feb 3 '13 at 22:08
link
up vote 10 down vote
What is the likely processor architecture of this snippet of binary data?
added by bushing Feb 4 '13 at 3:54
link
up vote 10 down vote
How can I reverse-engineer the statistical data file from my insulin pump controller?
added by bushing Feb 4 '13 at 4:07
link
Assuming a sample of the file were provided – ipmcc Feb 9 '13 at 0:14
up vote 10 down vote
How can I identify cryptographic functions in binaries?
added by Laszlo Feb 4 '13 at 4:50
link
up vote 10 down vote
How can I discover the functionality of an integrated circuit whose data sheet is not available?
added by nopnopgoose Feb 4 '13 at 5:56
link
up vote 10 down vote
What are common assembly patterns/tricks (e.g. hide moves and compares) from obfuscators to look out for?
added by samuirai Feb 4 '13 at 12:10
link
up vote 10 down vote
How do I extract the ROM contents of my embedded device?
added by Skyr Feb 4 '13 at 12:44
link
up vote 10 down vote
Are there any free videos/tutorials/resources that teach a beginner to get their feet wet on reverse engineering?
added by rev Feb 4 '13 at 13:40
link
up vote 10 down vote
My company has funded me to take a rev. engg. course. Which course would help me the most? I have extensive background in programming.
added by rev Feb 4 '13 at 13:43
link
up vote 10 down vote
Are there any good references for discovering and reverse engineering COM objects from PE files?
added by Modoc Feb 4 '13 at 13:45
link
up vote 10 down vote
What sandbox environments do you use to probe a binary and protect your local environment?
added by Modoc Feb 4 '13 at 13:49
link
up vote 10 down vote
What tools are available for visualizing the control flow graph of a binary?
added by Modoc Feb 4 '13 at 13:53
link
Isn't this a list question ? – AsheeshR Feb 15 '13 at 16:42
up vote 10 down vote
Does anybody recognize what this bit of assembly is supposed to accomplish?
added by Modoc Feb 4 '13 at 14:00
link
up vote 10 down vote
Are there any tools that can help with reverse engineering javascript deobfuscation of shellcode?
added by rev Feb 4 '13 at 14:31
link
up vote 10 down vote
What tools are available for reversing malicious pdf documents?
added by rev Feb 4 '13 at 15:05
link
up vote 10 down vote
we had a malware infection and I got hold of the executable. what is the safest way to reverse engineer the specimen?
added by rev Feb 5 '13 at 0:17
link
up vote 10 down vote
What can I do in my C program, that will be compiled using GnuC version x, to avoid reverse-engineering?
added by woliveirajr Feb 5 '13 at 14:28
link
up vote 10 down vote
Where should one begin when attempting to reverse engineer an unknown format or protocol?
added by Archenoth Feb 5 '13 at 22:12
link
up vote 10 down vote
I often see useless instructions like`lea esp, [esp]` in disassembly even though there is no obfuscation otherwise, am I missing something they do?
added by jix Feb 10 '13 at 13:49
link
up vote 10 down vote
Which compiler produces assembly code like this?
added by jix Feb 10 '13 at 13:57
link
up vote 10 down vote
What kind of bus protocol is used in this logic analyzer capture?
added by jix Feb 10 '13 at 14:04
link
up vote 10 down vote
How to identify compiler artifacts in a binary?
added by 2df Feb 12 '13 at 11:19
link
up vote 10 down vote
How can I identify debug detection code?
added by jyzuz Feb 15 '13 at 17:40
link
1 2