3

I am working on a HEX string, which I figured out is a binary. I would like some pointers on what to do next after I have disassembled from hex to assembly. I'm just assuming that the architecture is possibly x86 and used onlinedisassembler.com to convert to assembly code.

Is there a way I can run/debug using gdb? It's a challenge, so I would need to either run the assembly, debug it or do a static analysis and find out what's happening! Any help would be appreciated.

The disassembled code looks something like this (not sharing the whole thing, just first two lines):

                       .data:00000000 77 90                            ja     0xffffff92
                       .data:00000002 97                               xchg   edi,eax
1
  • 3
    Can you please share a few more lines? While your first two instructions doesn't really make sense as a start of a shellcode , 77 90 (decimal) can be translated to 0x4d 0x5a (Hex) Which is the famous "MZ" (ASCII) header of a PE file.
    – Megabeets
    Feb 17 '18 at 5:35
3

Write a program that would load that binary data to memory and jump with the execution to that area. If everything you assume is correct it will get executed (w/o problems) and you would be able to debug.

Really naïve loader might look like this (no error checking):

#include <stdio.h>
#include <sys/mman.h>

int main() {
    FILE *fp = fopen("data", "rb");

    fseek(fp, 0, SEEK_END);
    int size = ftell(fp); //size of you data
    rewind(fp);
    void *data = mmap(NULL, size, PROT_EXEC | PROT_READ | PROT_WRITE, MAP_ANON | MAP_PRIVATE, -1, 0);

    fread((void*)data, 1, size, fp);
    typedef void (*exec_func)(void);
    ((exec_func)data)();

    fclose(fp);
    return 0;
}

and if you data is

hexdump data

0000000 9090 0090                              
0000003

the it will execute 3xnop and crash.

1
  • thanks for guiding me, now I will figure out the next steps. Feb 16 '18 at 22:57
1

Try using radare2 (radare.org). It understands a variety of executable formats that it can disassemble.

Executables contain a header that controls loading the code into memory by the OS and where to start execution. So starting with the first byte of the file is not really the program itself. radare2 loads the executable and interprets the header and loads the actual code to disassemble it. Debug code etc...

radare2 my_program.exe

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.