reverse-engineering

问题 As part of the work I've been doing to answer this question about the technical workings of a glitch in Pokémon Red, I've been looking for a way to use a standard debugger to debug a Game Boy ROM. Although many of the emulators I've found have some support for debugging, nothing I've found so far has been helpful. As a background, as of now I have tried to use the Visual Boy Advance built-in features to do debugging, but they aren't particularly useful for what I'm trying to do. VBA lacks the

问题 I want to reverse engineer (import into diagram form) the database definition dump of a database I have, then since no foreign keys are defined in this particular database, I want to be able to manually create the table to table key mappings (using crow feet notation if possible). I've taken a look at MySQL Workbench, and it gets me 85% of the way there. The nice little relationship lines won't show up though, and the auto arrange is horrible. A quick search of google turns up several other

问题 Why the following assembly code is an anti-debugging tool? l1: call l3 l2: ;some code l3: mov al, 0c3h mov edi, offset l3 or ecx, -1 rep stosb I know that C3h is RETN and I know that stobs writes the value in al as opcode according to the offset in edi and it is done for ecx times because of rep . I am also aware the fact that stobs and stosw will run if they were pre-fetched on intel architecture as their original format. If we run the program in debugged mode the pre-fetch is irrelevant and

问题 Closed . This question needs to be more focused. It is not currently accepting answers. Want to improve this question? Update the question so it focuses on one problem only by editing this post. Closed 4 years ago . I want to sell my Java application using PayPal. When a payment is received, the customer is mailed a one-time download link to my application. My question is, how do I prevent people from sending the .jar file to their friends/uploading it on the internet? Obviously I need some

问题 Can I disassemble a flat binary file using objdump? I'm familiar with disassembling a structured binary executable such as an ELF file using: objdump -d file.elf But if I have a flat binary file that I know is supposed to be loaded at, e.g., address 0xabcd1000, can I ask objdump to disassemble it? I tried supplying options such as '--start-address=0xabcd1000' but objdump just states that it doesn't recognize the format. I have other ideas about how to disassemble the file but I wanted to know

问题 There have been a few articles recently about Google's new imageless buttons: http://stopdesign.com/archive/2009/02/04/recreating-the-button.html http://stopdesign.com/eg/buttons/3.0/code.html http://stopdesign.com/eg/buttons/3.1/code.html http://gmailblog.blogspot.com/2009/02/new-ways-to-label-with-move-to-and-auto.html I really like how these new buttons work in Gmail. How can I use these or similar buttons on my site? Are there any open source projects with a similar look & feel? If I

问题 After loading an executable into gdb, how do I break at the entry point, before the first instruction is executed? The executable I'm analyzing is a piece of malware that's encrypted so break main does absolutely nothing. 回答1: The info files command might give you an address you can break on: (gdb) info files ... Entry point: 0x80000000 ... (gdb) break *0x80000000 (gdb) run 回答2: Starting with GDB 8.1, there's a special command for this: starti . Example GDB session: $ gdb /bin/true Reading

问题 After loading an executable into gdb, how do I break at the entry point, before the first instruction is executed? The executable I'm analyzing is a piece of malware that's encrypted so break main does absolutely nothing. 回答1: The info files command might give you an address you can break on: (gdb) info files ... Entry point: 0x80000000 ... (gdb) break *0x80000000 (gdb) run 回答2: Starting with GDB 8.1, there's a special command for this: starti . Example GDB session: $ gdb /bin/true Reading

问题 After loading an executable into gdb, how do I break at the entry point, before the first instruction is executed? The executable I'm analyzing is a piece of malware that's encrypted so break main does absolutely nothing. 回答1: The info files command might give you an address you can break on: (gdb) info files ... Entry point: 0x80000000 ... (gdb) break *0x80000000 (gdb) run 回答2: Starting with GDB 8.1, there's a special command for this: starti . Example GDB session: $ gdb /bin/true Reading

问题 I'm trying to search for a function by its "signature". However I can't figure out what address range I'm supposed to be searching? I've had a look at VirtualQuery() and GetNativeSystemInfo() but I'm not if I'm on the right path or not. Edit: Question re-attempt. Using Win32 API I'm trying to find out how to get the start and end address of the executable pages of the process my code is executing in. This is what I've tried: SYSTEM_INFO info; ZeroMemory( &info, sizeof( SYSTEM_INFO ) );