Played N0PS CTF last week-end.
This is my write-up, with images.
#android #writeup #CTF #native #java #reverse #jeb #decompiler
1/4
So how many have you used dogbolt.com to take apart someone's code and see (or C) what they are doing?
IDA Pro v9.1 Released. Some highlights:
* Better compression on idb files
* Decompiler improvement on ARM, ARM64, RISCV, PPC
* Time travel debugging now supported on Windbg
* Heaven's gate supported on Windbg plugin
* Pass IDA command line parameters to open_database() function
* No support on Linux ARM64 unfortunately :/
It's out! r2dec-js a decompiler plugin for radare2 (version 5.9.8) was just released, I already did a recipe to build it on Haiku, but finished this up and merged it at haikuports. You can now use this in Terminal or in the Iaito application.
#HaikuOS #radare2 #radare #r2dec-js #Iaito #decompiler #reverseengineering
@HexRaysSA have announced IDA Pro v9.1 Beta
There are a lot changes, follow the link for changelog
https://docs.hex-rays.com/release-notes/9_1beta
Some highlights:
* Heaven's gate can now be debugged
* Rust version detection
* Improved decompilation on ARM64, RISCV, PPC
* Still no support for Linux ARM
#idapro #disassembler #decompiler #tooloftrade #reversing #reversengineering
I'm surprised at how badly #Ghidra decompiles this very simple function.
It's a syscall 0x57 which is unlink (remove a file).
I'm surprised it decompiles saying it *returns 0x57* ...
Spiegeln, Spiegeln an der Wand, wer ist der beste Decompiler im Land? Heute mal etwas mit dem neuen ghidra, angr-manager und IDA-Free gespielt... ich denke ich bleibe erstmal bei ghidra.
#decompiler #ghidra #ida #angr #angrmanager #cybersecurity #ctf
RULECOMPILE - Undocumented Ghidra decompiler rule language
Or “How I got annoyed by a poor decompilation so I unearthed a hidden Ghidra feature” TLDR: there is a (undocumented and disabled by default) feature in the Ghidra decompiler that lets you create your own decompiler passes, using a custom DSL. I leverage it to write a deobfuscation rule for a simple obfuscation technique. Story Setup - introduction and problem statement Decompiler 101 - building and using Ghidra decompiler directly RULECOMPILE - a curious #define flag from the decompiler source A forgotten language of dragons - reverse-engineering a forgotten code pattern matching DSL How to train your dragon - how to write a rule that is actually useful Conclusion - parting thoughts Story setup It all started with this one missed deobfuscation: