0

when I try to reverse my mips binary in radare2, I take some instruction invalid.

sudo r2 -a mips -b 32 -d 2700

start my binary:

sudo chroot . ./qemu-mips-static bin/resident

Sorry for this picture, but Internet in my pc is of:

rabin2

code

Program don't work, his fault and exit. Please help.

  • What is your version of radare2 (paste the output of r2 - v)? Is 2700 the pid of the process? Please share more information. – Megabeets May 4 '18 at 16:37
  • @Megabeets Yes, 2700 is a process. radare2 2.6.0-git 18087 @ linux-x86-64 git.2.5.0-176-gcbe9a12be commit: cbe9a12be2d1d8cc39b757b9034cb29ce097e768 build: 2018-05-04__22:24:54 – Vasiliy Kuramshin May 4 '18 at 19:28
  • What happens after you do e asm.bits=32 and than pd 10? – Megabeets May 4 '18 at 19:44
  • @Megabeets I try, but no change. I paste my e full config in main post. – Vasiliy Kuramshin May 4 '18 at 20:14
  • @Megabeets When I try 'e cfg.bigendian=true' the situation is improving slightly, but there are still unidentified teams. – Vasiliy Kuramshin May 4 '18 at 20:31
1

The the base address of the binary given as 0x60000000 in the screenshot (bin.baddr = 0x60000000). This does not seem to be correct. The address of the first loadable segment in the binary is 0x00400000, and the entry point address (in other words, the address of _start) is 0x405090.


By "this file" do you mean the one called resident from https://drive.google.com/open?id=1socXlGx84o25QpfNjNJRAR1ldM4IQoK0 ?

$ md5sum resident
75e019a169403e19eb59c59961d5bddf  resident

It came up clean on VirusTotal .

There is nothing remarkable about this binary as far as I can tell. The header is not malformed, there is no evidence of packing and the code in the binary can be disassembled just fine.

Entropy plot: file entropy plot

Hex dump of ELF header:

$ hexdump -C -n 52 resident
00000000  7f 45 4c 46 01 02 01 00  00 00 00 00 00 00 00 00  |.ELF............|
00000010  00 02 00 08 00 00 00 01  00 40 50 90 00 00 00 34  |.........@P....4|
00000020  00 01 91 30 70 00 10 07  00 34 00 20 00 08 00 28  |...0p....4. ...(|
00000030  00 1a 00 19                                       |....|
00000034

readelf -h output (take note of the entry point address 0x405090):

$ readelf -h resident 
ELF Header:
  Magic:   7f 45 4c 46 01 02 01 00 00 00 00 00 00 00 00 00 
  Class:                             ELF32
  Data:                              2's complement, big endian
  Version:                           1 (current)
  OS/ABI:                            UNIX - System V
  ABI Version:                       0
  Type:                              EXEC (Executable file)
  Machine:                           MIPS R3000
  Version:                           0x1
  Entry point address:               0x405090               <--------
  Start of program headers:          52 (bytes into file)
  Start of section headers:          102704 (bytes into file)
  Flags:                             0x70001007, noreorder, pic, cpic, o32, mips32r2
  Size of this header:               52 (bytes)
  Size of program headers:           32 (bytes)
  Number of program headers:         8
  Size of section headers:           40 (bytes)
  Number of section headers:         26
  Section header string table index: 25

A visual display of the above information:

ELF header visualization

disassembly beginning at entry point 0x405090:

$ r2 -a mips resident
 -- There's no way you could crash radare2. No. Way.
[0x00405090]> pd
            ;-- entry0:
            ;-- __start:
            0x00405090      03e00021       move zero, ra
            0x00405094      04110001       bal 0x40509c
            0x00405098      00000000       nop
            0x0040509c      3c1c0043       lui gp, 0x43
            0x004050a0      279cf770       addiu gp, gp, -0x890
            0x004050a4      0000f821       move ra, zero
            0x004050a8      8f848018       lw a0, -0x7fe8(gp)
            0x004050ac      8fa50000       lw a1, (sp)
            0x004050b0      27a60004       addiu a2, sp, 4
            0x004050b4      2401fff8       addiu at, zero, -8
            0x004050b8      03a1e824       and sp, sp, at
            0x004050bc      27bdffe0       addiu sp, sp, -0x20
            0x004050c0      8f87801c       lw a3, -0x7fe4(gp)
            0x004050c4      8f888020       lw t0, -0x7fe0(gp)
            0x004050c8      afa80010       sw t0, 0x10(sp)
            0x004050cc      afa20014       sw v0, 0x14(sp)
            0x004050d0      afbd0018       sw sp, 0x18(sp)
            0x004050d4      8f9983d0       lw t9, -0x7c30(gp)
            0x004050d8      0320f809       jalr t9
            < output snipped >

Take note of the address of the first loadable segment of the binary:

$ readelf -l resident

Elf file type is EXEC (Executable file)
Entry point 0x405090
There are 8 program headers, starting at offset 52

Program Headers:
  Type           Offset   VirtAddr   PhysAddr   FileSiz MemSiz  Flg Align
  PHDR           0x000034 0x00400034 0x00400034 0x00100 0x00100 R E 0x4
  INTERP         0x000134 0x00400134 0x00400134 0x00014 0x00014 R   0x1
      [Requesting program interpreter: /lib/ld-uClibc.so.0]
  REGINFO        0x000148 0x00400148 0x00400148 0x00018 0x00018 R   0x4
  LOAD           0x000000 0x00400000 0x00400000 0x166d8 0x166d8 R E 0x10000  <----
  LOAD           0x017000 0x00427000 0x00427000 0x00db0 0x00f18 RW  0x10000
  DYNAMIC        0x000160 0x00400160 0x00400160 0x000f0 0x000f0 RWE 0x4
  GNU_STACK      0x000000 0x00000000 0x00000000 0x00000 0x00000 RWE 0x10
  NULL           0x000000 0x00000000 0x00000000 0x00000 0x00000     0x4
  • 1
    OK. First, this not a virus, I think this a backdoor maid in factory. You check the static analys, if you see the 'strings' output, you see some intresting string. But I want dynamic analys. If I set 'bin.baddr' in start radare, it solve the problem? – Vasiliy Kuramshin May 6 '18 at 20:29
  • @VasiliyKuramshin The point is that there is no evidence of anti-analysis tricks. Section information is present, the entry point in conventional, etc. Meaning that the error you are seeing is not due to some aspect of the binary interfering with loading it into virtual memory. It is either emulation environment error or user error. Either way, it is not a reverse engineering problem. – julian May 6 '18 at 20:35
  • @SYS_V - what tool did you use to generate that header visualization? I haven't seen that before, looks pretty cool. – 3pidemix May 7 '18 at 1:53
  • @3pidemix it is a tool I am developing to visually explore ELF binaries. I can ping you once I release it, if you are interested. It will take a while though. – julian May 7 '18 at 2:22
  • 1
    Please do, it looks like it would be a great educational tool! – 3pidemix May 7 '18 at 2:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.