AÇIKÖĞRETİMLİLER FORUM
=> Daha kayıt olmadın mı?

http://testsorucevap.yetkinforum.com/index.htm adresinden AÇIKÖĞRETİM FORUM GİREBİLİRSİNİZ.

AÇIKÖĞRETİMLİLER FORUM - l7zoCRwK

Burdasın:
AÇIKÖĞRETİMLİLER FORUM => AÇIKÖĞRETİMLİLER FORUM => l7zoCRwK

<-Geri

 1 

Devam->


mBJO5ySOv (Ziyaretçi)
03.10.2015 21:32 (UTC)[alıntı yap]
In fact, there are some Binary code obsfucators have been using this kind of trick to fool IDA and pvreent manual analysis:.text:00010EB5 mov [esp+8], eax.text:00010EB9 push ecx.text:00010EBA mov eax, [esp].text:00010EBD mov [esp+8], eax ; DATA XREF: .text:00010AF2o.text:00010EE8 retnSo I think maybe multi code xref or data xref should be added to ret.Additionaly I think IDA could try to backtrace the stack top to automatic resolve some these tricks.There aren't any GUI command to add data xref or code xref in IDA now.Maybe it's better to expose them to the user than SDK/script only.When I use the SDK function to add code xref IDA wouldn't add automatic comments to some indirect jump or call such as call [edx], I had to add the comment manually, would IDA support automatic comments to manual added xrefs in 5.1?Additionaly more and more obsfucators using unconditonal jump such as:w造12.text:00011276 push eax.text:00011277 push [esp+0Ch+var_C].text:0001127A mov eax, [esp+0].text:0001127D mov [esp+10h+var_C], eax.text:00011281 jmp loc_11332loc_11332: ; CODE XREF: sub_11276+Bo.text:00011208 push edi.text:00011209 mov eax, esp.text:0001120B jmp loc_113FBto split one node into mutiple nodes, maybe IDA graph could reassemble them together when the jump target is one-indegree node.I think these kind of trick would be used in more and more software to protect themselves from being analyzed within one or two years.

Cevapla:

Nickin:

 Metin rengi:

 Metin büyüklüğü:
Tag leri kapat



Bütün konular: 4
Bütün postalar: 9
Bütün kullanıcılar: 3
Şu anda Online olan (kayıtlı) kullanıcılar: Hiçkimse crying smiley
AÇIKÖĞRETİM BİLGİLERİ
 
Daha hiç link yok!

Senin linkin burada olsun mu?
O zaman buraya kaydını yaptır:
=> Kayda git
 
 

 

 
h. Bu web sitesi ücretsiz olarak Bedava-Sitem.com ile oluşturulmuştur. Siz de kendi web sitenizi kurmak ister misiniz?
Ücretsiz kaydol