Rolf Rolles

@RolfRolles

Static reverse engineering, deobfuscation, program analysis and formal verification, training, mathematics, compilers, functional programming, etc.

Berkeley, California
msreverseengineering.com
Vrijeme pridruživanja: srpanj 2009.

Medijski sadržaj

  1. 7. sij

    I recently discovered 's channel on YouTube. A lot of stuff about old video game copy protections (arcade, console, PC), emulation, game development, etc. Good production values, too. Great stuff for reverse engineering enthusiasts.

    29 proslijeđenih tweetova 148 korisnika označava da im se sviđa
  2. 18. pro 2019.

    A recent result: deobfuscation via relational abstract interpretation

    6 replies 30 proslijeđenih tweetova 189 korisnika označava da im se sviđa
  3. 12. pro 2019.
    Odgovor korisniku/ci

    I must be missing something -- IDA has all of those VTable structures already? (With function pointer types, not just names.) E.g. I selected four at random and all were available via "Add standard structure", see attached

    5 korisnika označava da im se sviđa
  4. 5. pro 2019.
    Odgovor korisnicima

    Found it. The keyboard shortcut is 4,451 characters long, though.

    1 reply 2 korisnika označavaju da im se sviđa
  5. 27. lis 2019.
    Odgovor korisniku/ci

    That was never a problem; here's one.

    9 korisnika označava da im se sviđa
  6. 27. lis 2019.

    Research went better than expected. No manual work was involved in creating this screenshot. All type information was automatically generated and automatically applied to a freshly-created database.

    10 replies 55 proslijeđenih tweetova 269 korisnika označava da im se sviđa
  7. 29. srp 2019.
    Odgovor korisnicima

    The disassembler does support that; use the "structure offset chooser" (place your cursor on the operand and press 'T') after importing the JNINativeInterface structure.

    1 reply 2 proslijeđena tweeta 36 korisnika označava da im se sviđa
  8. 9. srp 2019.
    Odgovor korisniku/ci

    That's correct -- I made a list of instructions observed as causing page faults and implemented mostly only those. For flags-setting instructions, I just thunk down to assembly, for speed, and so I don't have to implement them.

    1 korisnik označava da mu se sviđa
  9. 15. lip 2019.
    Odgovor korisniku/ci

    Perusing Ghidra's ARMneon.sinc, it uses intrinsics for those instructions. Hex-Rays has good support for x86 intrinsics (see pic), but apparently lacks some on ARM. It would not be difficult for them or third-parties to add them. An annoying limitation, but not a fundamental one.

    1 reply 2 korisnika označavaju da im se sviđa
  10. 6. svi 2019.
    Odgovor korisnicima i sljedećem broju korisnika:

    Lucky you! Sitting next to on a panel discussion at ACSC was one of the proudest moments of my career.

    23 korisnika označavaju da im se sviđa
  11. 2. svi 2019.

    Another example expressing an XOR relationship:

    1 proslijeđeni tweet 16 korisnika označava da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
  12. 2. svi 2019.

    Just spent an hour looking at MBA obfuscation for the first time. At first glance it seems pretty trivial to break with some abstract algebra. (This was done automatically, based on black-box dynamic analysis, not using a SAT/SMT solver or any third-party libraries):

    6 replies 13 proslijeđenih tweetova 63 korisnika označavaju da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
  13. 19. ožu 2019.

    Ghidra's extensibility is jaw-dropping. Today I needed the pcode to model the x86 parity flag, which it doesn't do by default. 30 minutes and a 35-line patch to ia.sinc later, I can proceed. No other tool even comes close to how easy that was. (diff: …)

    6 replies 112 proslijeđenih tweetova 376 korisnika označava da im se sviđa
  14. 18. ožu 2019.

    Promptly delivered and as advertised, A+++, would win contest again

    4 proslijeđena tweeta 81 korisnik označava da mu se sviđa
  15. 8. ožu 2019.

    1250 lines of Java later, I ported one of my abstract interpretation-based deobfuscation tools () to Ghidra:

    132 proslijeđena tweeta 394 korisnika označavaju da im se sviđa
  16. 28. velj 2019.
    Odgovor korisniku/ci

    "I wish I knew how Hex-Rays worked internally, so I could write better plugins for it." Three months later...

    4 proslijeđena tweeta 27 korisnika označava da im se sviđa
  17. 31. sij 2019.
    Odgovor korisnicima i sljedećem broju korisnika:

    Here, for example, is a paper about Java. Yet most Java programmers don't know, or need to know, that stuff. That information is for language implementers, tool developers, and researchers.

    1 reply 3 korisnika označavaju da im se sviđa
  18. 20. pro 2018.
    Odgovor korisnicima

    Looks like I will be deprived of future updates on IdaKiller.js

    23 korisnika označavaju da im se sviđa
  19. 1. pro 2018.

    Hoffman and Kunze define it as a function, and make reference to representation theory:

    1 reply 1 proslijeđeni tweet 14 korisnika označava da im se sviđa
  20. 3. stu 2018.
    Odgovor korisniku/ci

    It all started when I wanted to know how "Create new struct type..." worked, and it sort of spiraled from there ;-)

    2 proslijeđena tweeta 10 korisnika označava da im se sviđa

@RolfRolles još nije poslao/la nijedan tweet s fotografijama ili videozapisima.

Čini se da učitavanje traje već neko vrijeme.

Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.

    Možda bi vam se svidjelo i ovo:

    ·