Comments on: [MMA 2015] [Reverse – How to use?] Write Up https://0x90r00t.com/2015/09/07/mma-2015-reverse-how-to-use-write-up/ 0x90r00t, 0x90r00f Thu, 10 Sep 2015 07:28:43 +0000 hourly 1 https://wordpress.org/?v=6.8.2 By: Tsuka https://0x90r00t.com/2015/09/07/mma-2015-reverse-how-to-use-write-up/#comment-583 Thu, 10 Sep 2015 07:28:43 +0000 https://0x90r00t.com/?p=794#comment-583 In reply to WtF.

Thank you very Much.

]]> By: WtF https://0x90r00t.com/2015/09/07/mma-2015-reverse-how-to-use-write-up/#comment-578 Wed, 09 Sep 2015 23:36:32 +0000 https://0x90r00t.com/?p=794#comment-578 In reply to Info.

You have to use the decompiler (and not just stay in disassembler mode) :
File / Produce file / Create C file…

If you haven’t all the returned int values in the file, you have to attach the DLL to rundll32.exe:
– Choose windbg as debugger
– Debugger / Process options…
– Application : rundll32.exe

As example:
– howtouse_without_windbg.txt
– howtouse_with_windbg.txt

]]> By: Info https://0x90r00t.com/2015/09/07/mma-2015-reverse-how-to-use-write-up/#comment-572 Wed, 09 Sep 2015 22:28:08 +0000 https://0x90r00t.com/?p=794#comment-572 In reply to WtF.

From IDA, how did you get the result to look so “readable”. Mine mostly came out with assembly commands.

]]> By: WtF https://0x90r00t.com/2015/09/07/mma-2015-reverse-how-to-use-write-up/#comment-554 Wed, 09 Sep 2015 11:51:00 +0000 https://0x90r00t.com/?p=794#comment-554 In reply to Hackndo.

Yes I used IDA 🙂
You can also decompile the DLL with :
– Hopper
– the Capstone engine + a python decompiler script
– radeco

]]> By: Hackndo https://0x90r00t.com/2015/09/07/mma-2015-reverse-how-to-use-write-up/#comment-549 Wed, 09 Sep 2015 10:26:39 +0000 https://0x90r00t.com/?p=794#comment-549 In reply to sudhackar.

We commonly use IDA Pro for reversing and decompiling. WtF did this challenge, but given his decompiling result, I would assume he used IDA.
(I’ll let him confirm though)

]]>