Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

But what if the CPU assumes the instruction stream is compressed?


In the slide 9, they show the frequency of each 16-bit value. In a compressed code, the frequency of each value should be almost equal.

10 or 20 years ago, when reverse engineering any unknown file it was a good to assume it was no compressed and you could get some insight looking at the hex editor and hopping the best. Now many are compressed, so a good first step is to change the extension to .zip and try WinRar (or look for a header if you are not lazy).

I assume that with compressed code you can use the same strategy. Try to assume it's using a well known compression algorithm, and crossing your fingers.


7zip, unar, innoextract...

And, of course, upx.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: