Have you ever tried to create a debugger for Mac OS X? It is an adventurous enterprise with lots of unexpected (should I say unforeseeable?) problems. This guy tried and described his adventures in this entertaining post: http://www.matasano.com/log/1100/what-ive-been-doing-on-my-summer-vacation-or-it-has-to-work-otherwise-gdb-wouldnt/ His post reminded me of all problems we faced with the first version of the IDA debugger for iMac. […]
Read MoreThe last week I attended the Recon conference. It was a very enjoyable event, very nicely organized and handled, in a charming city (Montreal). Since I haven’t seen many conferences yet, I can not really compare it to others but I think it was really great: real RE stuff with no superficial talks. […]
Read MoreSoftware programs must be tested before put in use. When there is a single program, things are relatively simple. Running it on multiple platforms is more challenging because it requires testing all of them. But the real nightmare starts when there are multiple programs running on multiple platforms and going to a high abstract level […]
Read MoreThe decompiler makes some assumptions about the input code. Like that call instructions usually return, the memory model is flat, the function frame is set properly, etc. When these assumptions are correct, the output is good. When they are wrong, well, the output does not correspond to the input. Take, for example, the following snippet: The […]
Read MoreIt works! There are lots of limitations but it is alive, handles breakpoints, exceptions, and even some limited tracing is available. It is possible to launch processes and attach to them. Here is just one screenshot: Expect many limitations in the first version (no hardware bpts, limited multithread support, etc). One of the most annoying shortcomings […]
Read MoreThings are quite easy with the Symbian TRK! Today I decided to write a small program to interact with it and everything worked extremely smoothly. My driver program can download a SIS file to the phone, automatically install and run it. It reacts to debugging events and gracefully closes the connection when the application […]
Read MoreYesterday I created my first Symbian program 🙂 Sure enough, it was a “hello world” and to tell the truth I did not write it myself. But it still took me 3 (three) hours to get it running on Nokia E51. The good side is that I learned a lot about possible failures with Symbian […]
Read MoreA brilliant blog post by Ero Carrera: IDAPython in action: http://blog.dkbza.org/2008/03/digging-up-system-call-ordinals.html Just note how concise and powerful is the script!
Read MoreJust a quick post to announce that we have published a small plugin to specify jump table information. When IDA misses them, the flow charts are virtually useless – they fall apart into several loosely connected components and the logic is completely hidden. This plugin is especially useful for rarely used processors with unusual switch […]
Read More