What function is responsible for resolving function

Assignment Help Database Management System

Reference no: EM133859893

PART 1

ANALYZING SHELLCODE

Lab Description: The goal of this lab is to analyze shellcode to determine its functionality.

This shellcode begins at an offset of +0xE86. Once you load the binary file in Binary Ninja (BN) the view will be as a hex editor. Right-click on this offset and select 'Create Function at this Address' -> 'x86' -> 'x86'. Begin analysis at this location.

Lab Environment: This lab requires the following tools:
Disassembly tool such as IDA Pro demo/free or Binary Ninja Demo
A debugger
Lab Files that are needed: shellcode.bin

Determine the following by analyzing the sample shellcode:

Question 1: What function is responsible for resolving function addresses? How did you determine the function?

Question 2: What is being done starting at offset +0xE8F through +0xE9B? What is in EAX when those instructions are done?

Question 3: Identify where the process hollowing is performed (hint, it's towards the end of function sub_e86). Describe how this technique works, be specific. Include screenshots, descriptions and all API calls involved.

PART 2

REVERSING C++
Lab Description: Reversing software requires the ability to identify and effectively analyze a wide variety of code constructs and patterns. For this lab, the student is required to reverse engineer a C++ program that uses objects.
Lab Environment: You will be required to disassemble the provided lab file using IDA Pro by Hex-Rays. You may use the free/demo version of IDA and will need an OS supported by the free/demo version.
Lab Files that are Needed: ReversingCPP.exe.

Analyze the provided lab file and answer the following questions:
1. How many objects are created?
What is the size of that object/what are the sizes of those objects?
3. Does the first class have a virtual function? Include a screenshot with answer.
4. Does the second class inherit the first class? Include a screenshot with answer.
5. What is Jerry's number (ID)?
6. What is Bruce's number (ID)?
7. Is Jerry a base object or a derived object? Include a screenshot with answer.
8. Is Bruce a base object or derived object? Include a screenshot with

Reference no: EM133859893

Questions Cloud

Which precautions should hospital staff take to lessen : While inserting an IV into a client's forearm, the nurse accidentally. Which precautions should hospital staff take to lessen the risk of needlestick injuries?

Which nursing interventions should the nurse implement first : The nurse is caring for a client recently diagnosed with polycystic ovarian syndrome (PCOS). Which nursing interventions should the nurse implement first?

Reported pretending to be asleep and holding his breath : According to the patient, he perceived Nurse Mawuena as rough and rude during their interactions, reported pretending to be asleep and holding his breath

Which drugs is most appropriate for this condition : A doctor prescribes a medication to a patient diagnosed with anxiety. Which drugs is most appropriate for this condition?

What function is responsible for resolving function : What function is responsible for resolving function addresses? How did you determine the function and What is being done starting at offset

Recent reconstruction at the local hospital residence : A recent reconstruction at the local hospital residence that were changes to the patient care units.

Hospital because he is having trouble breathing : A 64-year-old man with a number of health issues comes to the hospital because he is having trouble breathing.

Which conditions is most likely? : A 13-year-old female presents for evaluation of bloating, stomachache, and occasional loose stools. Which conditions is most likely?

US health care delivery over the past century : What role has technology played in shaping both the advancements and challenges in U.S. health care delivery over the past century?

User Account

All Pages