OpenRCE

📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.

About Articles Book Store Distributed RCE Downloads Event Calendar Forums Live Discussion Reference Library RSS Feeds Search Users What's New

Customize Theme

Topic created on: April 16, 2007 16:20 CDT by modest .

Any known method for process identification by raw code? Maybe statistical approach?

asotirov		April 16, 2007 21:02.22 CDT
What do you mean by "raw code" and "process identification"?

aeppert		April 16, 2007 21:13.30 CDT
Do you mean the native processor for a given binary? If so, it really depends - if it is ELF or PE, it is very straight forward and documented. If for instance it is a flat binary from say firmware, then a statistical approach may be feasible given most binaries have a known prologue and epilogue.

modest		April 17, 2007 07:41.59 CDT
> If for instance it is a flat binary from say firmware, then a statistical approach may be feasible given most binaries have a known prologue and epilogue. Yes. Any known tools and stat databases are exist?

aeppert		April 17, 2007 08:42.16 CDT
Not in a cumulative public fashion no. You should be able to find the prologues and epilogues of most major processors via google though. This would certainly include, x86, PowerPC and MIPS.

Note: Registration is required to post to the forums.

There are 31,328 total registered users.

Imagery

SoySauce Blueprint
Jun 6, 2008