Questions tagged [binary-analysis]
The process of gathering information about a binary file, either with static or dynamic methods.
562
questions
0
votes
0
answers
22
views
SIM card firmware
I'm trying to look into inner workings of smart cards. I'm familiar with APDUs, PC/SC and the ways of communicating with a smart card. I'm more interested in the firmware (bootloader/OS) that is ...
- 1
0
votes
0
answers
24
views
Is There any way to deobfuscate armdot .net Obfuscator?
ArmDot is a .NET obfuscator to protect software written in dotnet.
I wanted to know are there is any way to deobfuscate and get the original File.
- 31
0
votes
1
answer
115
views
Asking for Reverse Engineering Tool Ideas
I'm currently studying cybersecurity and IoT and I'm interested in working on a development project in the realm of reverse engineering. My level is somewhere between beginner and intermediate, and I'...
- 3
0
votes
0
answers
85
views
Extracting / converting an unknown 1990s graphics file format (.ATR)
For about a month I've been working towards trying to crack the file structure on the graphical assets from the old JumpStart CD-ROM games. A large percentage of these games do not have their sprites ...
0
votes
1
answer
36
views
RAM and Registers Analysis EMS3150 ECU TriCore TC1767
I extracted the firmware of an EMS3150 ECU, TC1767 chip.
I analysed the binary with the help of a hex editor and the TC1767 manual.
I managed to successfully load the binary in IDA Pro, with correct ...
- 128
0
votes
0
answers
24
views
Why does dup2(2) function has no effect here?
I am trying to solve The Protostar Net One task.
When I open the net1 binary with strace -f ./net1 I get this result. In which the program clones itself, kills the parent, and dups all standard file ...
- 1
0
votes
0
answers
23
views
Going from NAND dump to firmware update package
I.... Have no idea what I'm doing.
So, I did a full NAND dump of an Actions ATJ2257 based MP4 player (url: https://archive.org/details/eclipse-t-2810-c.-7z) and I want to recreate the ".fw" ...
- 183
1
vote
1
answer
37
views
Looking for a tool for visualising potential can bus data in binary log file
I have some log files that I was able to record from a device that I believe is running a CAN bus (standard frame not extended).
There is no possibility of real time physical access to the bus.
I'm ...
- 113
0
votes
1
answer
74
views
extract third party libraries names and versions used in BIN files
i am having an issue trying to extract third party libraries from bin files and lost on how to go on this.
a bit about my background: i am junior software engineer that have no knowledge about reverse ...
- 1
0
votes
0
answers
42
views
How to unpack firmware .bin file
I need help to unpack or create python script to unpack automatically the type of this firmware, someone already unpacked this firmware, and it contains: boot.bin, aboot.bin and system.bin files. (...
- 11
1
vote
1
answer
66
views
How to extract 7z archive with LZMA compression
I have firmware file, which contains a raw MIPS32 binary code.
I used binwalk to scan for signatures binwalk -B -t image.out and for executable opcodes binwalk -A -t image.out
Top part of the output:
...
- 235
0
votes
0
answers
49
views
Save game files
I recently decided to embark on the adventure of reverse engineering game save files and I am trying to modify the Eternium game data, I have tried to see similarities between the different saves but ...
0
votes
0
answers
22
views
Why pwndbg interprets the input as a command but not as input to the program?
I'm debugging a program which has anti-debug techniques. One was to detect ptrace which pwndbg evaded easily but now the when the program expects an input pwndbg interprets it as its own command ...
- 101
0
votes
0
answers
34
views
I extracted a file from inside the dump that contains the serial number and I need to analyze it
I extracted a file from inside the dump that contains the serial number and I need to analyze it
I want to unpack and compress this encrypted file after modifying it
0
votes
0
answers
37
views
The dumb dvr performs factory settings automatically and does not save the settings
I have a DVR device from Hikvision that does not save any changes or settings, and when it is restarted, it returns to the factory state... I tried another dump, not from the same brand name, and it ...
0
votes
2
answers
88
views
Finding the address of a function in an exe that I have the source code of
I've been playing around with some leaked source codes and I find that locating a function in source in the compiled exe is not so straight forward. And i'm thinking what are the ways to get that ...
- 3
1
vote
1
answer
75
views
Static offsets Vs. Loaded Offsets
I am developing an application integrity concept tool that performs integrity checks based on a comparison of Windows syscalls in a static PE file on disk to those loaded. Can I match the offset of ...
- 11
0
votes
0
answers
43
views
Dynamic analysis of cmd dependent software
There is a PE file, which can't run by itself, and can only be called from cmd.exe, it doesn't create independent processes, and can be launched independently only with .bat scripts, which without &...
0
votes
1
answer
62
views
Offset addressing
I’m writing a C-SKY (CK803S) processor module for IDA Pro, and a question arose about offsets in transitions, small ones are fine, but long ones lead to nowhere, from the documentation:
in code I ...
- 13
1
vote
0
answers
43
views
Potential vulnerabilities in a binary run as root
I am given a vulnerable 64-bit stripped application, it conducts basic password strength checks on linux(/etc/shadow). The application receives workers(which creates worker process for performing the ...
- 111
0
votes
0
answers
55
views
Help determine 3d model vertex structure serialized binary
Help determine 3D model vertex structure serialized binary.
Example of single vertex:
A3 D0 5D BA C9 27 3F 3A DC 6C 87 3B 2B 75 EE 00
FF FF FF FF 92 2F 29 80 B1 19 64 3F 02 82 1D 3F
What I got so far:...
- 1
0
votes
0
answers
104
views
Help Extracting a CramFS filesystem from .img binary
I'm trying to extract a CramFS filesystem from a firmware binary for the FVS318Gv2. It downloads as a .zip file that can be decompressed to reveal a firmware .img file and a readme.htm. Running ...
- 1
0
votes
0
answers
66
views
Decompile or analyse injected /usr/bin/cat
I'm trying to decompile or analyse an injected Linux executable binary file /usr/bin/cat ,and find the injected code as a readable.
Need some tips as a beginner how to find the injection method if it'...
0
votes
0
answers
46
views
Unknown Mitsubishi automotive MCUs - are these using unknown architecture?
Please help ientify the architecture (ISA) of MH8200F and MH8110F which is found almost exclusively on Mazda ECUs with L3CK, L587, L5E8, LFAR, LFFR, LFJP firmwares
I've revealed that the MH8501F is ...
- 1
1
vote
1
answer
178
views
VxWorks flat binary file
VxWorks has a "flat binary file" format in which the initial 8 byte values are 45 53 54 46 42 49 4E 52 (ESTFBINR if interpreted as ASCII).
I know very little about their content except:
...
- 31
0
votes
0
answers
595
views
Hello Watch 3+ smart watch firmware extracting
I have a firmware file of Hello Watch 3+ smart watch. I want to customize this firmware. I tried binwalk but no result. I am trying reverse engineering for the first time. Can you help me?
File link: ...
0
votes
0
answers
74
views
Requesting Guidance To Understand SuperScape's .VCA Format: Lego Creator Knights Kingdom
I hope you all are doing well and staying safe.
I am in the process of trying to understand how SuperScape stored data in their .VCA/LCA format, so I can extract the original SHAP and PAL data from ...
- 1
1
vote
0
answers
166
views
Analyse a statically linked binary and extract syscall from it using angr
How to extract all syscalls from analysing a statically linked binary.
I have a script written using angr(Latest - v9.2.78) but when I start my script I get few syscalls and the analysis is like hung ...
- 11
0
votes
0
answers
31
views
Why can't I resolve the 'system' dynamic addresss in ret_2_libc exploit?
First and foremost, I am a noob pwner. The problem at hand is from TryHackMe.com > pwn101 > pwn109. A simple ret_2_libc in which you exploit a simple buffer overflow, leak the addresses of gets()...
1
vote
0
answers
40
views
Old Windows CE 5.0 device image repair
I need to repair an old industrial device, based on Intel XScale PXA255 and Windows CE 5.0. It has a bootloader on NOR Flash and OS image and filesystem partitions on NAND. I've disassembled ...
- 11
0
votes
0
answers
28
views
Why would unreadable data recovered from a drive be non-recoverable?
I ran Disk Drill on a drive that was a member in a failed software RAID mirror on macOS. The drive seemed to be fine, but was showing up as "uninitialised", so the drive didn't fail as such ...
0
votes
0
answers
228
views
Need Help Cracking a Program
So I've got this .exe that I want to crack. It's an old management system for people in truck loading business.
I kind of understand what's happening with window API calls but I'm unable to access the ...
0
votes
0
answers
276
views
Need help in opening of binary files
Need help with unreadable Far Cry 6 binary format (.spx)
Hi everyone, name is Adi :-).
For the past few weeks I've been searching for a solution to a problem that the Far Cry Modding Community with me ...
- 1
1
vote
0
answers
46
views
Retrieve functionality to button - game patching
I'm patching an old game, and I want the retrieve the toggle fullscreen functionality it's supposed to have.
In the menu, in the display tab, there is a disabled option of fullscreen mode that you can ...
- 21
2
votes
2
answers
2k
views
UPX Unpacking tool
Firstly, thank you for your answer.
What is the best unpacking tool to use to unpack - UPX 0.89.6 - 1.02 / 1.05 - 1.24 ->[Overlay] could you please provide a link so i can obtain as such.
Thank ...
- 21
2
votes
2
answers
267
views
How can I find the buffer of CryptGenRandom?
I am trying to analyze the CryptGenRandom algorithm on my Windows 10 laptop.
According to Niels Ferguson's Whitepaper called 'The Windows 10 random number generation infrastructure', the ...
- 83
0
votes
1
answer
305
views
How to pass an SVD file as an argument to IDA Pro in the command line (batch mode)?
I am trying to disassemble a few Arm Cortex-M3 .elf binaries and run a custom IDAPython script (script.py) from the command line (in batch mode). I have been able to do that with the following command:...
2
votes
2
answers
133
views
Determine Endianess of some ARM binary image?
I have been advised to analyze an ARM binary image from an Cortex M3 (STM32) for training. It has been directly extracted from flash beforehand and passed to me. However it's unknown whether this ...
- 121
1
vote
0
answers
104
views
angr - project.loader.find_symbol("main") does not works
I have very simple C code - compiled on MSVC using clang++ compiler. When I am running it under angr environment - it simply does not finds main() function, while it can do so for other things like ...
- 121
3
votes
1
answer
662
views
How to reverse Engineer a Struct in IDA Pro?
How to identify and define a struct in IDA pro Decompiling during reverse engineering?
Please explain the easiest way to figure out the struct in IDA Pro decompilation!
To make life easier are there ...
2
votes
0
answers
660
views
Please help identify which type of CPU architecture is used on obscure portable media players
I am trying to reverse engineer a media player with obscure SigmaTel SoCs just for fun but I didn't find very useful information.
As far as I don't know exactly what CPU architecture is used on these ...
- 21
3
votes
1
answer
137
views
What type of bin is this file?
Can someone help me what type of BIN file is that and can i read what is inside ? Thanks
https://easyupload.io/673djh
- 31
3
votes
0
answers
251
views
PEStudio DLL analysis: flag in export section
I start to use PEStudio for DLL analysis; I understand (more or less) everything, except the "exports (flag)" section:
What does it mean the X in the flag column? So, what is a/the flag?
...
- 131
1
vote
0
answers
243
views
Get all names of functions from an iOS-App binary (headless)
Setup:
I want to get a list of all (apple built-in) function and variable names that are used in an arbitrary iOS App by headless analysis. So given the .ipa file of any iOS-App, I unpack it and can ...
4
votes
1
answer
143
views
💻 This code does not crash on ARM (qemu). Why?
I found a couple of interesting integer underflows leading to memcpy() wild copies in a TLV parser process of some random IoT firmware. It is 32-bit ARMv7.
I'm able to emulate the userspace process ...
- 61
4
votes
1
answer
192
views
Mickey Mouse toy bin file analysis
I am trying to reverse engineer a Mickey Mouse toy just for fun but I am stuck.
The toy has several buttons that play various phrases and songs.
My aim was to see if I can read those songs from the ...
4
votes
0
answers
220
views
How to assemble back a disassembled Linux kernel?
I have a Linux kernel file and I need to tweak the contents of its corresponding initramfs. I did it in the past for standard distros where kernel and initramfs were separate. However, this specific ...
- 141
3
votes
1
answer
64
views
GNU strings with --encoding=S
I have two binaries. Both contain the string "precondition failed" (without the quotes).
The corresponding byte sequence 70 72 65 63 6C 65 64 00 is the same for both binaries. However, the ...
- 1,560
2
votes
2
answers
96
views
Decoding a list of integer values in unknown format
I'm attempting to reverse engineer a binary file format which is used to encode a list of integer values. I can't work out how this format works, as the number of bytes used to encode each value ...
- 73
2
votes
0
answers
68
views
Buffer overflow gets() weird parsing
I'm attempting to do a buffer overflow with gets(). I've figured out how to write over the return address and I'm able to do so, however, I cannot write in the address I need because the 0x7F at the ...
- 21