reverse-engineering

问题 So we have like this safes challenge in assembly, you need to create safes and keys that will break them and end the infinite loop. Here's an example for a safe: loopy: mov ax, [1900] cmp ax,1234 jne loopy and a key: loopy2: mov ax, 1234 mov [1900],ax jmp loopy2 So I have a safe and a key, and I don't understand why it doesn't work: here's my safe: org 100h mySafe: mov dx,5 mov ax, [5768h] mov bx,7 mov word [180h],2 mul word [180h] mov [180h],bx push ax dec bx mov cx,dx mov ax,dx loopy1: add

问题 I'm trying to query a MySQL server to determine information about a database in order to scaffold some code. I've been quite successful using Java JDBC and INFORMATION_SCHEMA table for this but the problem is that I need to determine if a table relation is OneToOne , OneToMany or ManyToMany . I can't find a good way to achieve this and I would love if someone could help me a bit and if its possible with a solution that is not MySQL specific and solid so it could help others. I found this

问题 I have a trace instruction and want to extract function calls and returns. I found that except call instruction, push + jmp and push + ret can be used for function call? At first I want to be sure is that correct? and if yes what are the differences between them? Also if push + ret is kind of call so what would be the end or return of a function? Seeing only ret without push instruction before it? 回答1: Yes, you are correct. When a call is issued, the return address pushed onto the stack is

问题 I have a trace instruction and want to extract function calls and returns. I found that except call instruction, push + jmp and push + ret can be used for function call? At first I want to be sure is that correct? and if yes what are the differences between them? Also if push + ret is kind of call so what would be the end or return of a function? Seeing only ret without push instruction before it? 回答1: Yes, you are correct. When a call is issued, the return address pushed onto the stack is

问题 I am trying to detect whether my process is being run in a debugger or not and, while in Windows there are many solutions and in Linux I use: ptrace(PTRACE_ME,0,0,0) and check its return value, I did not manage to perform the same basic check on Mac OS X. I tried to use the ptrace(PT_TRACE_ME,0,0,0) call but it always returns 0 even when run under gdb. If I change the request to PT_DENY_ATTACH it correctly stops the debugging but that is not what I want to achieve. Any ideas? 回答1: You can

问题 I am trying to detect whether my process is being run in a debugger or not and, while in Windows there are many solutions and in Linux I use: ptrace(PTRACE_ME,0,0,0) and check its return value, I did not manage to perform the same basic check on Mac OS X. I tried to use the ptrace(PT_TRACE_ME,0,0,0) call but it always returns 0 even when run under gdb. If I change the request to PT_DENY_ATTACH it correctly stops the debugging but that is not what I want to achieve. Any ideas? 回答1: You can

问题 I am trying to detect whether my process is being run in a debugger or not and, while in Windows there are many solutions and in Linux I use: ptrace(PTRACE_ME,0,0,0) and check its return value, I did not manage to perform the same basic check on Mac OS X. I tried to use the ptrace(PT_TRACE_ME,0,0,0) call but it always returns 0 even when run under gdb. If I change the request to PT_DENY_ATTACH it correctly stops the debugging but that is not what I want to achieve. Any ideas? 回答1: You can

问题 I am trying to detect whether my process is being run in a debugger or not and, while in Windows there are many solutions and in Linux I use: ptrace(PTRACE_ME,0,0,0) and check its return value, I did not manage to perform the same basic check on Mac OS X. I tried to use the ptrace(PT_TRACE_ME,0,0,0) call but it always returns 0 even when run under gdb. If I change the request to PT_DENY_ATTACH it correctly stops the debugging but that is not what I want to achieve. Any ideas? 回答1: You can

问题 I am trying to detect whether my process is being run in a debugger or not and, while in Windows there are many solutions and in Linux I use: ptrace(PTRACE_ME,0,0,0) and check its return value, I did not manage to perform the same basic check on Mac OS X. I tried to use the ptrace(PT_TRACE_ME,0,0,0) call but it always returns 0 even when run under gdb. If I change the request to PT_DENY_ATTACH it correctly stops the debugging but that is not what I want to achieve. Any ideas? 回答1: You can

问题 I am trying to detect whether my process is being run in a debugger or not and, while in Windows there are many solutions and in Linux I use: ptrace(PTRACE_ME,0,0,0) and check its return value, I did not manage to perform the same basic check on Mac OS X. I tried to use the ptrace(PT_TRACE_ME,0,0,0) call but it always returns 0 even when run under gdb. If I change the request to PT_DENY_ATTACH it correctly stops the debugging but that is not what I want to achieve. Any ideas? 回答1: You can