Questions tagged [binary-analysis]
The process of gathering information about a binary file, either with static or dynamic methods.
0
votes
0answers
11 views
Wrong RVA values inside IMAGE_IMPORT_DESCRIPTOR
I load the entire PE into an std::vector<Byte> fileContent using std::fstream.
Then I obtain the executable's dos header:
IMAGE_DOS_HEADER* imageDosHeader = (IMAGE_DOS_HEADER*)fileContent.data(...
0
votes
3answers
59 views
What to do with .dd files? [closed]
Okay so I am doing picoCTF and I am very new to ctf. Now in one of the questions I am given a .dd file and the hint says Some files have been deleted from the disk image, but are they really gone?
I ...
0
votes
0answers
48 views
Bypass App Protection
So I'm trying to unpack some application I have but it gives me really hard time.
I'm starting from the system entry point and give it a shot, the application then jump into TLS callback of the loaded ...
1
vote
1answer
49 views
Remove Binary from IDA Database
I saw the File -> Load File -> Additional Binary File option and tried it out. Now I want my original IDA database back (with just one binary), but can't afford to lose the comments I have saved ...
1
vote
0answers
40 views
Is there any way to capture the state of an application so as to restore execution of it later?
There are certain older, non-DirectX-based games that I can hack inside of a VM, which is amazing because I can save snapshots of states to then restore if, say, the game crashes after I attempt ...
1
vote
0answers
99 views
Naruto Uzumaki Chronicles 2 .RAW Files [PS2]
I'm have been trying to mod these game for years, but I still stuck with the raw files from RACJIN games, [same case as Fullmetal Alchemist & Bleach]. The files appear to be compressed, and a ...
3
votes
0answers
44 views
How do I perform concolic execution with Angr and collect constraints on input?
I have a program that takes a string (with some structure) as input. My aim is to collect information on what values each character in input is compared to as it gets parsed using concolic execution. ...
4
votes
1answer
59 views
Heap Chunk Structure Does Not Contain Previous Section Info
I'm reading Shellcoder's Handbook to learn more about exploitation and overflows. I reached the chapter on Heap Overflows. The book mentions that a heap is split into chunks where each chunk contains ...
1
vote
1answer
63 views
What is the difference between stripped binary and obfuscated binary
I want to know the difference between stripped binary and obfuscated binary.
4
votes
2answers
46 views
Are some special chars(<>) in function names not supported by windbg/cdb?
I have a function in a binary like this class<class1::class2>::function. I can't directly use commands like bp, u, x on the function. The only option I have right now is x class* and then look ...
0
votes
1answer
78 views
Algorithm to find secret cipher S-box in bin file [closed]
Is there any algorithm that searches through binary file and detects existence of secret S-box built from look-up table (4 bit or 8 bit)? Consider the sbox is unavailable for public
The attached bin ...
0
votes
0answers
17 views
Using yara to obtain information from binary (not matching)
I would like to use yara to extract information from a binary.
I went through the doc but did not understand how to always get a certain piece of information. For example:
import "dotnet"
rule ...
0
votes
0answers
57 views
IDA doesn't see code
I'm trying to analyze some binary but IDA doesn't see code inside .reloc section. I loaded it manually, changed segment class from DATA to CODE and marked as executable. In 010 Editor these bytes are ...
0
votes
1answer
83 views
When to create a keygen versus when to bypass the security jumps
I am a newbie reverse engineer.
I was wondering: assuming I want to crack a program (With the permission of the author of course) and I have detected the Assembly where the program begins to check the ...
2
votes
1answer
90 views
Binwalk does not show anything when process binary
I tried use Binwalk to extract content of binary firmware image dumped from flash, but Binwalk does not show anything.
I tried commands
binwalk -Me file.bin
binwalk --dd='.*' file.bin
strings ...
6
votes
0answers
93 views
Analyzing a Revit project file
I've been messing around with Revit and trying to understand the internal data structures for its file format. I'm not particularly experienced with this type of work and the processes around reverse ...
1
vote
1answer
48 views
Detect interesting testcases
Suppose I have a ton of test cases and my target is closed-source. Well, I need to know which test cases discover new path in the execution of my target and which are duplicated. I know I have to use ...
1
vote
0answers
82 views
What is the format of this binary file?
I have a binary file that I found on a 3D printer that is used to program a dsPIC30F5011 microcontroller. It is responsible for some basic data encryption. The only problem is, I am not sure how this ...
0
votes
1answer
93 views
Is this firmware using a substitution cipher?
I'm trying to extract data from a firmware file.
I used binwalk on the firmware, which found a single chunk of Zlib compressed data. I uncompressed this data, and used strings on the result, which ...
3
votes
2answers
46 views
Finding a particular call to an offset within a vtable using pattern matching
Let's say I have a very simple pattern I'm looking for. E.g. the following regex,
mov.*(eax|edx|ecx|esi|edi), \[(eax|edx|ecx|esi|edi)\+30h\]
Now, I'm also looking for references to this in which the ...
1
vote
1answer
24 views
Why would an ELF SHT_REL section contain relocations outside the section its sh_info refers to?
I have a .so from an Android JNI/NDK application. Here are two of its sections:
[Nr] Name Type Addr Off Size ES Flg Lk Inf Al
[10] .rel.plt REL ...
1
vote
0answers
42 views
How to make sense of this one pin serial communication
I am trying to reverse engineer a serial communication between to microcontrollers (1 device & 1 microcontroller on a board). One MCU validates the other MCU and I want to crack the validation and ...
1
vote
0answers
113 views
Unknown Game Client Data
As asking a friend and no amount of Googling yielded an answer, I figured I'd make an account and give this place a go.
I'm working on reverse engineering the server for a relatively old game with no ...
4
votes
1answer
110 views
Is this Bignum multiplication of 2048 RSA number a Montgomery multiplication?
The below code snippets are some kind of bignum multiplications involving 2048bit numbers, possibly in the context of RSA decryption.
Does any one recognize this pattern?
Is it maybe some kind of ...
3
votes
1answer
99 views
What are the popular machine learning unsupervised approaches to learning binary data representations?
This is somewhat open-ended question, so bear with me please.
Be it a binary payload that you pull from network packet, firmware blob you pull of some EPROM or data intercepted straight from physical ...
3
votes
1answer
77 views
What are the steps to reverse engineering a Shockwave .DCR file?
I have been fascinated by reverse engineering after making several emulators and finding the pret community. I love the idea behind decompiling old games and recreating source code that recompiles ...
3
votes
2answers
155 views
Is pointer decryption possible?
I’m pretty new to reverse engineering, so bear with me...
I’m trying to get a few struct definitions (or whatever they’re called) from this one binary. After some time fiddling around with it, I’ve ...
0
votes
0answers
40 views
Identify variable length header encoding
I have a file generated by Microsoft OneNote Online service. It contains a lot of attached binary files and I need to extract all of them.
All attachments are stored inside the file in the following ...
-3
votes
1answer
149 views
Identification of AES portion code in binary
I want to locate AES code portion in binary after reverse engineering. I have tried to locate manually and using plugin findcrypt2 but I was not successful. Kindly show me a direction so that I can ...
1
vote
1answer
204 views
r2pipe won't prompt for user input like the binary does in r2 debugger mode
Have a functioning r2pipe script, but there's a need for hitting crtl-c to continue near the breakpoint(not a major issue,) however the script does not pause for input when the crackme asks for user ...
0
votes
1answer
94 views
how to understand branch arm instruction
I have this instruction F6F700B8 I know that it b #-0xA000 but how I can understand from F6F700B8 that is b #-0xA000 ? .
When I tried to translate it on http://armconverter.com/hextoarm/ I get B.W #...
1
vote
2answers
57 views
How is the IV generated from a timestamp based on this function?
Background: I am currently looking to make some diagnostic software interoperable with other software, but all communication that occurs in this software is encrypted with AES-128-CBC. A sample ...
1
vote
1answer
225 views
bypassing anti-VM inside protected samples
This is a good starting point.
As you know:
Sandboxes and virtual environments (hypervisors) are full of artifacts that betray their analysis environment. Malware can protect itself against these by ...
0
votes
1answer
102 views
IDA Pro Address doesn't correlate to Immunity Debugger address
I'm trying to use immunity debugger to step through a confusing binary.
When I open it in IDA Pro, I see certain addresses next to the instructions:
.text:01001392 inc eax
When I ...
7
votes
2answers
365 views
Radare2 Find command line arguments and location in stack
This might have a simple solution but I can't find it anywhere.
$> ./be1 11 AAAAA
With gdb, finding argv[] and argc is simple:
(gdb) print argv[0]@argc
$7 = {0xbffff872 "be1", 0xbffff89a "11", ...
-1
votes
1answer
35 views
Understanding what is represented by function pointers to a block of hex
I'm working on a disassembly project for my class where I'm trying to bypass a license check, but when I throw the executable into Binary Ninja this is what I see:
And when I look at those pointers, ...
0
votes
1answer
39 views
Ldr arm thumb2 must be multiple of 4?
I saw here http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0489c/CIHDGFEG.html that on arm thumb2 ldr must be multiple of 4.
I run on arm thumb 2 and want run this instruction ldr r0, ...
5
votes
0answers
147 views
How to find if a given library function is used in a binary?
Assuming that library X is statically linked, is there a way to know with an acceptable grade of confidence if a function from it was used in the binary?
I am currently using this approach:
Convert ...
0
votes
1answer
63 views
Arm function save registers r0 and r1
I see arm 32 bits assembly code.
Usually each function do push { r4-r9,lr} ( save 6 registers on stack ). And in the end of function pop them .
I see function that save push {r0,r1,r4-r9,lr} but ...
0
votes
2answers
141 views
How to obtain memory address of string literal?
I am trying to find where a specific string literal is used in a compiled program. I have already found the location of this string literal within the executable; I want to somehow deduce what the ...
0
votes
1answer
169 views
How ida choose arm Thumb/Thumb2
I load binary file to ida and choose arm cpu.
How can I see if ida choose on arm/arm Thumb2 / arm Thumb? and how can I change it?
Bytes translate is depend witch arm is it(arm/arm Thumb2 / arm ...
2
votes
2answers
117 views
Arm ldr diffrent between # and =
In ARM assembly, what is the difference between
ldr r4, =0x44454433
and
ldr r4, #0x44454433 ?
1
vote
2answers
75 views
Test malware files in host machine?
To analyze malware files we are using virtual machine and virtual box but some of malware detect the environment and will not do its work properly.
I want to know how to test malware files with out ...
0
votes
0answers
108 views
Reversing an APK to replicate API, X-Request-Sign5
I have been reverse engineering an APK in order to create a Desktop client for an app (just for fun to improve my analytical/programming skills). I have, however, hit a snag. Most requests sent to ...
-1
votes
1answer
186 views
Converting object file to LLVM bitcode
Frameworks like mcsema is used to convert an executable file into LLVM bitcode which can be further used to perform program analysis.
Is there any way to convert an object file in the similar way?
0
votes
1answer
122 views
reverse engeeneering the 3d file of a game [closed]
I have a problem to find out how to open a file of a game this one seems to have encrypted its files.
Currently all I know about the file is that it seems to be a custom 3D file.
here is the file ...
1
vote
1answer
209 views
How to add new language to ARM firmware
I have piece of firmware (download from here) and I need to get access to its filesystem.
Here is the output of a binwalk scan:
root@kali:~/Desktop/E1200YDXNB1_OLAANB1# binwalk --dd=".*" ps.bin
...
3
votes
1answer
217 views
No apparent entry point for stripped, PIE binary using radare2
I am running on 64-bit Windows 7 and am using radare2 to attempt both static and dynamic analysis of a binary executable. The issue is that I cannot seem to find the entry point of where the program ...
0
votes
1answer
42 views
Where Is device specific information kept on smart devices
I am doing a project for school on Emulation of device using its firmware. Using firmadyne, I can start up the smart device unfortunately because it is not a real device, information fields like ...
1
vote
1answer
400 views
Binwalk could not extract the full content
Binwalk v2.1.1 on Ubuntu, and tried to research Zyxel Router firmware. First I unzipped FW, there was 3 files:
360AUG0C0.bin, 360AUG0C0.rom, AUG107.bm
I used binwalk to extract content of bin file, ...
