Questions tagged [binary-analysis]
The process of gathering information about a binary file, either with static or dynamic methods.
462
questions
0
votes
1answer
31 views
How to export arm64 and x86-64 binary into one?
I am trying to export a binary that contains both AARCH64-64 and x86-64 in Ghidra. I only opened the x86-64 counterpart to perform some changes.
When I tried to export it, it exported a .bin file that ...
0
votes
1answer
29 views
IDAPython, parse IDA DB as PE file
I have buffer loaded into IDA with IDAPython in a costume loader script, I want to now to be parsed as a PE, or in fact, it would be better if IDA will try to reparse it as a PE, is it possible ...
0
votes
0answers
23 views
Advanced Binary Exploitation CTF
I wanted to ask your assistance: Where can I find advanced ctfs (that hopefully contain solutions) regarding binary/kernel exploitation? I am interested on finding x86_64 linux/windows/arm64 that ...
0
votes
1answer
42 views
usercalls in old Win32 game
I am currently analyzing an old Win32 game from 1999 that was probably compiled with Visual C++ 6 and was programmed in C.
I noticed that there are almost no usercalls (i.e. calls that use registers ...
2
votes
1answer
157 views
The Knowledge of Compiler for becoming a good Reverser
I just reached the the topic of Compilers in the book "Reversing:Secrets of Reverse Engineering" So, I want to ask, is the knowledge of Compilers necessary for becoming a Malware Reverse ...
2
votes
4answers
78 views
finding sequence of opcode in binary
I have dis-assmebled binary and want to check if it contains particular sequence of opcodes(obtained from other reference binary). how to do that . i know plain byte
level comparison wont work as as ...
2
votes
2answers
75 views
C++ structure containing a RTTI getter function?
I'm working on reversing a C++ application and I've come across a structure that contains a getter function that returns TypeDescriptor*, I've read some articles on RTTI and reversing C++ but can't ...
0
votes
0answers
18 views
What is .data.rel.ro used for in GO on Linux?
I'm reversing a GO binary, and I was trying to locate where some symbols appear in the binary. I did the following:
Used nm on the binary - which did not recognize any symbols
Used go tool nm - same ...
0
votes
0answers
28 views
Bypassing debugger detection in radar2
I'm currently doing a reversee engineering challenge. I disassembled the ELF binary in radare2, however the binary checks whether its attached to a debugger. How can i bypass this detection ? Thanks ...
0
votes
0answers
32 views
Issue Debugging in IDA PRO
I am analyzing a binary file to retrieve the password. It requires a userID and password. By analyzing I need to crack the password. But after running through IDA it is being terminated.
First, I used ...
1
vote
1answer
140 views
Correct way to understand local_ in ghidra disassembly
Attached is the part of a disassembled main from a x86 binary file, generated by ghidra.
**************************************************************
...
1
vote
1answer
70 views
Mul(Multiplication) in x64 and in x32 assembly
I'm completely new in malware reverse engineering. I'm stuck in a confusion that,
I studied that in x32, mul instruction multiplies the source with eax register and store the result as 64 bit value ...
1
vote
1answer
80 views
Defining all undefined functions
I analyzed a binary, and lots of functions weren't detected as such - the bytes weren't detected as assembly. I read about the Aggressive Instruction Finder analysis and used it. Now the instructions ...
0
votes
0answers
96 views
How do reverse-engineers feel comfortable with not knowing the 'big picture'?
One of the biggest barriers in my journey of learning reverse-engineering seems to be the fact that I feel rather uncomfortable being confused about the 'big picture' of what I am reversing and not ...
0
votes
0answers
35 views
Unpack old DLink DIR-855 firmware
I'm trying to reverse engineer an old firmware of the D-Link DIR-855. The latest binary can be found here: ftp://ftp.dlink.de/dir/dir-855/driver_software/DIR-855_fw_reva_124eub01_ALL_multi_20130614....
0
votes
1answer
39 views
Getting the object name through the Ghidra Script
I have a script written to work with ghidra. I am doing some analysis in the script and save the results in a file. Right now, I am passing the name when a prompt ask the file name to save upon ...
1
vote
0answers
87 views
Modify bin firmware file of an old phone
I am trying to remove/disable some system apps ( Messages, Games, Radio or Calendar ) and remove/replace the boot screen from samsung E1200y.
So i start searching for the way to do that...
I used HxH ...
0
votes
0answers
66 views
Alternative to BinDiff that works on Linux x86_64 binaries (and preferably does not require IDA Pro)
Is there alternative to
https://www.zynamics.com/bindiff.html
that works for Linux x86_64 binaries, works on Linux, (and preferably does not require IDA Pro, however if needed it seems that IDA can ...
0
votes
0answers
37 views
binwalk not showing file descriptions (signatures) after 1st try
I have a bin file that shows a list of lzma compressed files which I extracted generically to .7z files using this format "binwalk -D "elf 32-bit lsb shared object":.so image.bin"
...
1
vote
0answers
24 views
advice for retrieving functions and tables from intel 8061/8065 bin file (reverse engineering) from Ford EECV ECU
I have under my disposal some Ford EECV bin files and my goal for the next few weeks is to retrieve the functions and tables and plot them out before going onto DIY hardware . .
Does anyone know which ...
3
votes
1answer
134 views
Confusing syntax found in malware
I am confused by what the following command is doing:
00401234 mov dword [esp+0x35], sub_408678
For context, I'm reversing a piece of malware and am using Binary Ninja, which to my knowledge ...
0
votes
0answers
31 views
Radare2: Running executable from a specific point
I am using radare2 to reverse engineer a standard crackme executable. I have obtained the password, but now I need use the program to read & print a restricted file to which the executable has ...
1
vote
1answer
99 views
Statically Reverse Engineering Shellcode - IDA to Ghidra
I'm trying to follow along with this tutorial which is using IDA in it's example. https://0ffset.net/reverse-engineering/malware-analysis/common-shellcode-techniques/
Hash: ...
0
votes
0answers
41 views
String as constant , even not visible in disassembler
I was reading this article Where I saw that while reversing the WinRAR I saw that the x64dbg is not able to search for a string in all modules "evaluation copy". but why is that happening. ...
0
votes
0answers
131 views
Modify Strings in a ELF (Executable and Linking Format) that are stored in the .rodata
I have 2 ELF files here, each containing strings in the ".rodata" for an translation that I want to modify.
The first ELF "(binary1)" I have already successfully modified from ...
0
votes
1answer
54 views
Static Binary in Windows
I am learning more about binary exploitation on windows. But I saw while revering a binary that you can create static binaries in windows too just like in Linux. It was really ugly. if I would be on ...
0
votes
2answers
109 views
How to find the file address of AddressOfEntryPoint
I have a binary file and in the optional header I have the address of the entry point 0x00011046 but when I put the file inside HEX editor this address doesn't exist, more than that 0x000097f0.
I ...
5
votes
2answers
969 views
Difference between Main and Entry
Sometimes, I see while disassembling a binary that there is the main function. but sometimes, instead of main, there is entry function.
I want to know what is the difference between entry and main.
0
votes
2answers
99 views
What should I learn in order to reverse elf64 binary files
I'm a little confused. I am using a Linux based system (Ubuntu), 64-bit. and I want to start and reverse 64elf binary files, but there is a lot of things I want to know before. just to be clear, If I ...
2
votes
1answer
150 views
How do we decompile java so easy?
I have seen a lot of videos where everyone is decompiling the jar files so easily. but I learnt that we cannot decompile any compiled file so easily. I have a little bit of experience in Gidhra. I ...
1
vote
1answer
63 views
Confusion between different ARM architectures
I am trying to develop a machine learning model to help with the process of reverse engineering. As the first stage, we are currently trying to train an embedding model that understand the ...
1
vote
1answer
67 views
Identifying the nature and contents of a file
As a preface, I do not have any experience in reverse engineering. I am an application developer, so this field is way out of my area of expertise. My end goal is to create a web page out of this ...
1
vote
1answer
220 views
How to extract information from a binary file knowing the target info
I have some measured data comes from a various types of sensors. The sensors are connected to a data-logger in order to store measurement data. After measurement, the data transported and stored in a ...
0
votes
2answers
83 views
How does an executable’s static API differ from it’s dynamic API?
Running an executable in Cuckoo sandbox gives me its dynamic API information. How do these API calls differ from their static API information (eg. If I were to just put the executable through IDA Pro ...
0
votes
1answer
138 views
How to find function start in stripped binary?
Given C code, are the function addresses from the ELF the same as those in the stripped version?
I don't have any specific code in mind. Just trying to learn in general how to find the function ...
1
vote
0answers
30 views
PE Format - How can I delete IMAGE_IAT_DIRECTORY and the app still runs fine?
I’m doing a small research regarding PE files and while I drilled every related question or the documentation itself I couldn’t explain this issue.
Why can I go to CFF explorer or some other PE ...
2
votes
1answer
101 views
Getting android app from device for reversing - what if there are multiple apks?
For analyzing and reversing android apps, where the target app is installed on an android phone, usually there is a base.apk file on the device, and there are various ways to find this apk file on the ...
5
votes
2answers
238 views
What kind of function creates this code pattern?
Apologies if this is a duplicate. Don't know what words to search for as that's what the question is about.
I'm relatively new to reverse engineering binaries and while using Ghidra I've noticed that ...
3
votes
2answers
553 views
C++ Unary equals (unary operator=)
In C++ binaries, I find Qt methods like ??4QString@@QEAAAEAV0@AEBV0@@Z which demangle to
public: class QString & __ptr64 __cdecl QString::operator=(class QString const & __ptr64) __ptr64
or ...
2
votes
1answer
165 views
How to set the type of a variable or function to an std::string?
I'm using IDA Pro and have identified a function that takes an std::string as an argument.
However when I click on the function and "Set Item Type", entering its definition:
std::__ndk1::...
0
votes
1answer
2k views
What does 'test al, al' mean?
I'm trying to reverse engineer a program and i found the following instruction:
test al, al
je label
what does these two instruction do ? Can someone explain please ?
8
votes
0answers
224 views
Extracting strings from Go binaries
Is there an easy way to extract all of the strings from Go binaries that will work cross architecture?
The problem with Go is that strings are stored without a null terminator so you can't use the "...
1
vote
0answers
53 views
What to do with a text file of disassembly code and binaries?
I am fairly new to software reverse engineering and I'd like to know how proceed with analyzing a program if I have a text file of disassembly code and a bin file of binary data. I understand ...
0
votes
0answers
55 views
Combine two ELF binaries
Without having access to the original source code, is there a way to combine two ELF binaries with the main() in the first binary pointing to the main() in the second binary ?
In other words, I mean ...
0
votes
0answers
36 views
Is there any tool that finds common things like strings among large number of binaries?
So this is really needed in malware analysis, for example if i have 1000 samples from a family and i want to know which strings are common among all of them, it would really help to have a tool that ...
0
votes
0answers
141 views
How to reverse engineer Apple MacBook SMC update firmware image using IDA Pro 7.2?
Alright so I have watched extraordinary presentations videos from three different reverse engineers who hacked the Apple SMC Update firmware:
Charlie Miller:
https://www.youtube.com/watch?v=...
0
votes
0answers
101 views
How to force IDA to properly parse the ELF header?
Is possible to force IDA to parse the elf file into its appropriate fields without resorting to IDC/IDApython, I mean is there a built-in functionality that I'm missing?
For instance it possible to ...
2
votes
0answers
36 views
dwarf: variable offset from base
I have a simple code:
int main()
{
int a = 4;
printf("%d\n", a);
a = 8;
if (a == 8)
printf("%d\n", a);
return 0;
}
DIEs for the function and variable:
<1><32a>: Abbrev ...
0
votes
1answer
69 views
Need some help and advices as regards as reverse engineering IoT devices
Hi everyone, I saw this video on youtube as regards as reversing IPTV cameras and finding security vulnerabilities: Black Hat 2013 - Exploiting Network Surveillance Cameras Like a Hollywood Hacker
I ...
0
votes
0answers
70 views
How can I reassemble a DDS header with the information I have?
I have 2 files which I know for certainty to be as follows:
File 1: Includes all of the DDS image data
File 2: Includes some data from the header. The data it includes is the width and the height (...
