Questions tagged [binary-analysis]
The process of gathering information about a binary file, either with static or dynamic methods.
477
questions
0
votes
0answers
11 views
How to modify checksum after making changes in Nokia 215 4G firmware?
If I change any character in the firmware file and try to flash it, it will failed. But it will successfully flashed if I changed the string with the same number of character if it's not a function.
...
0
votes
0answers
43 views
Help to find the main menu apps in Nokia firmware
I am trying to custom Nokia 215 4G firmware
I want to remove specific apps like games, radio, browser...
If not removing it, redirecting it OR even damage it. So when you click on an app it will open ...
0
votes
0answers
27 views
What type of file has the file signature 'BOOT'?
I have a .bin file which I am trying to disassemble into something that I can edit. Given that binary files can contain just about any binary data, I found it difficult to assess what file data is ...
0
votes
1answer
28 views
The Logic Of Incremental Data on Serial Communication Encoding
These are the serial communication reverse values.
I am trying to understand the logic behind this.
I am pretty sure that 2 bytes represent 1 byte(high byte and low byte), values are correct.
I tried ...
0
votes
0answers
42 views
Understand the AES encryption mode
I am reverse engineering a software that implements its own encryption over HTTP. The implementation is very simple, the client has the server's public key which it uses to encrypt the data it sends ...
1
vote
1answer
128 views
Arrays assembly
I'm reversing my C array's programs where I'm storing numbers in arrays like this...
int marks[5];
marks[0] = 1;
marks[1] = 3;
marks[2] = 2;
marks[3] = 7;
marks[4] = 9;
so the compiler showing me the ...
0
votes
1answer
71 views
Why compiler is doing this?
While I was disassembling my own C code for practice I saw an interesting point which I want to share with you guys and needs to know the answer as I always get from here. Now, the interesting point ...
0
votes
0answers
59 views
How to Find Password/ Bypass Password in a Switch Statement using IDA
I'm new to reverse engineering, wondering how access or bypass the password contained in the switch statement ?
File Link
2
votes
1answer
77 views
Not able to understand the C-switch statement in disassembly
While I'm trying to disassemble my own C code I am stuck in a problem of not understanding how this Switch statement is implemented in assembly code. Can anyone please help to figure it out? This the ...
0
votes
0answers
30 views
IDAPython NtCreateFile
Let's say I want to print the filenames on every call to NtCreateFile
(With %any% exe loaded in IDA )
The first problem is to get the ntdll!NtCreateFile address
Tried to do it like this ...
4
votes
2answers
206 views
Why do reversers nowadays reverse engineer using decompilers and not disassemblers?
I see many reverse engineering lessons and every second person does reverse engineer using Ghidra decompiler and not disassembler as both are available in the same platform. I assume that reversing ...
0
votes
0answers
38 views
Control flow graph of entire binary file
Is it possible to get the control flow graph of the entire binary file using any disassembler? IDA Pro generates the CFG for each function. Can we use it to get the CFG of the entire program?
0
votes
0answers
44 views
Possible ways to reverse enginerring the boot file
I am trying to take files from the file called LOADING.KWI
it is the boot file for multimedia, located on the loading sdhc card, which should be inserted in multimedia's slot, without this card the ...
0
votes
0answers
58 views
finding a not-so-straightforward game's function
I am working on Mad Max game [ APEX engine ]
I do my best to explain the situation.
so my target executes function like this:
there are commands like " call [eax+XX] " or " call RX &...
0
votes
1answer
32 views
How to force a program to run as monothread for dynamic analysis?
I'm reversing a program with x64dbg and ida (I switched from ghidra), hence disassembled and decompiled, I need to understand what is happening with dynamic analysis, but I have a tricky part where ...
3
votes
2answers
72 views
How to figure out functionality when doing Static Code Analysis in ASM?
When doing Static code analysis on a disassembled app, I usually end up seeing many calls to registers (CALL EAX for example), which is constructed in runtime, which leaves me clueless on how to ...
0
votes
1answer
57 views
How to export arm64 and x86-64 binary into one?
I am trying to export a binary that contains both AARCH64-64 and x86-64 in Ghidra. I only opened the x86-64 counterpart to perform some changes.
When I tried to export it, it exported a .bin file that ...
0
votes
1answer
40 views
IDAPython, parse IDA DB as PE file
I have buffer loaded into IDA with IDAPython in a costume loader script, I want to now to be parsed as a PE, or in fact, it would be better if IDA will try to reparse it as a PE, is it possible ...
0
votes
0answers
55 views
Advanced Binary Exploitation CTF
I wanted to ask your assistance: Where can I find advanced ctfs (that hopefully contain solutions) regarding binary/kernel exploitation? I am interested on finding x86_64 linux/windows/arm64 that ...
0
votes
1answer
55 views
usercalls in old Win32 game
I am currently analyzing an old Win32 game from 1999 that was probably compiled with Visual C++ 6 and was programmed in C.
I noticed that there are almost no usercalls (i.e. calls that use registers ...
2
votes
1answer
174 views
The Knowledge of Compiler for becoming a good Reverser
I just reached the the topic of Compilers in the book "Reversing:Secrets of Reverse Engineering" So, I want to ask, is the knowledge of Compilers necessary for becoming a Malware Reverse ...
1
vote
4answers
89 views
finding sequence of opcode in binary
I have dis-assmebled binary and want to check if it contains particular sequence of opcodes(obtained from other reference binary). how to do that . i know plain byte
level comparison wont work as as ...
2
votes
2answers
85 views
C++ structure containing a RTTI getter function?
I'm working on reversing a C++ application and I've come across a structure that contains a getter function that returns TypeDescriptor*, I've read some articles on RTTI and reversing C++ but can't ...
0
votes
0answers
31 views
What is .data.rel.ro used for in GO on Linux?
I'm reversing a GO binary, and I was trying to locate where some symbols appear in the binary. I did the following:
Used nm on the binary - which did not recognize any symbols
Used go tool nm - same ...
0
votes
0answers
32 views
Bypassing debugger detection in radar2
I'm currently doing a reversee engineering challenge. I disassembled the ELF binary in radare2, however the binary checks whether its attached to a debugger. How can i bypass this detection ? Thanks ...
0
votes
0answers
32 views
Issue Debugging in IDA PRO
I am analyzing a binary file to retrieve the password. It requires a userID and password. By analyzing I need to crack the password. But after running through IDA it is being terminated.
First, I used ...
2
votes
1answer
317 views
Correct way to understand local_ in ghidra disassembly
Attached is the part of a disassembled main from a x86 binary file, generated by ghidra.
**************************************************************
...
1
vote
1answer
240 views
Mul(Multiplication) in x64 and in x32 assembly
I'm completely new in malware reverse engineering. I'm stuck in a confusion that,
I studied that in x32, mul instruction multiplies the source with eax register and store the result as 64 bit value ...
1
vote
1answer
146 views
Defining all undefined functions
I analyzed a binary, and lots of functions weren't detected as such - the bytes weren't detected as assembly. I read about the Aggressive Instruction Finder analysis and used it. Now the instructions ...
0
votes
0answers
101 views
How do reverse-engineers feel comfortable with not knowing the 'big picture'?
One of the biggest barriers in my journey of learning reverse-engineering seems to be the fact that I feel rather uncomfortable being confused about the 'big picture' of what I am reversing and not ...
0
votes
0answers
62 views
Unpack old DLink DIR-855 firmware
I'm trying to reverse engineer an old firmware of the D-Link DIR-855. The latest binary can be found here: ftp://ftp.dlink.de/dir/dir-855/driver_software/DIR-855_fw_reva_124eub01_ALL_multi_20130614....
0
votes
1answer
61 views
Getting the object name through the Ghidra Script
I have a script written to work with ghidra. I am doing some analysis in the script and save the results in a file. Right now, I am passing the name when a prompt ask the file name to save upon ...
2
votes
0answers
111 views
Modify bin firmware file of an old phone
I am trying to remove/disable some system apps ( Messages, Games, Radio or Calendar ) and remove/replace the boot screen from samsung E1200y.
So i start searching for the way to do that...
I used HxH ...
0
votes
0answers
106 views
Alternative to BinDiff that works on Linux x86_64 binaries (and preferably does not require IDA Pro)
Is there alternative to
https://www.zynamics.com/bindiff.html
that works for Linux x86_64 binaries, works on Linux, (and preferably does not require IDA Pro, however if needed it seems that IDA can ...
0
votes
0answers
57 views
binwalk not showing file descriptions (signatures) after 1st try
I have a bin file that shows a list of lzma compressed files which I extracted generically to .7z files using this format "binwalk -D "elf 32-bit lsb shared object":.so image.bin"
...
1
vote
0answers
28 views
advice for retrieving functions and tables from intel 8061/8065 bin file (reverse engineering) from Ford EECV ECU
I have under my disposal some Ford EECV bin files and my goal for the next few weeks is to retrieve the functions and tables and plot them out before going onto DIY hardware . .
Does anyone know which ...
3
votes
1answer
137 views
Confusing syntax found in malware
I am confused by what the following command is doing:
00401234 mov dword [esp+0x35], sub_408678
For context, I'm reversing a piece of malware and am using Binary Ninja, which to my knowledge ...
0
votes
0answers
32 views
Radare2: Running executable from a specific point
I am using radare2 to reverse engineer a standard crackme executable. I have obtained the password, but now I need use the program to read & print a restricted file to which the executable has ...
1
vote
1answer
150 views
Statically Reverse Engineering Shellcode - IDA to Ghidra
I'm trying to follow along with this tutorial which is using IDA in it's example. https://0ffset.net/reverse-engineering/malware-analysis/common-shellcode-techniques/
Hash: ...
0
votes
0answers
45 views
String as constant , even not visible in disassembler
I was reading this article Where I saw that while reversing the WinRAR I saw that the x64dbg is not able to search for a string in all modules "evaluation copy". but why is that happening. ...
0
votes
0answers
240 views
Modify Strings in a ELF (Executable and Linking Format) that are stored in the .rodata
I have 2 ELF files here, each containing strings in the ".rodata" for an translation that I want to modify.
The first ELF "(binary1)" I have already successfully modified from ...
0
votes
1answer
61 views
Static Binary in Windows
I am learning more about binary exploitation on windows. But I saw while revering a binary that you can create static binaries in windows too just like in Linux. It was really ugly. if I would be on ...
0
votes
2answers
211 views
How to find the file address of AddressOfEntryPoint
I have a binary file and in the optional header I have the address of the entry point 0x00011046 but when I put the file inside HEX editor this address doesn't exist, more than that 0x000097f0.
I ...
5
votes
2answers
991 views
Difference between Main and Entry
Sometimes, I see while disassembling a binary that there is the main function. but sometimes, instead of main, there is entry function.
I want to know what is the difference between entry and main.
0
votes
2answers
141 views
What should I learn in order to reverse elf64 binary files
I'm a little confused. I am using a Linux based system (Ubuntu), 64-bit. and I want to start and reverse 64elf binary files, but there is a lot of things I want to know before. just to be clear, If I ...
2
votes
1answer
195 views
How do we decompile java so easy?
I have seen a lot of videos where everyone is decompiling the jar files so easily. but I learnt that we cannot decompile any compiled file so easily. I have a little bit of experience in Gidhra. I ...
1
vote
1answer
65 views
Confusion between different ARM architectures
I am trying to develop a machine learning model to help with the process of reverse engineering. As the first stage, we are currently trying to train an embedding model that understand the ...
1
vote
1answer
74 views
Identifying the nature and contents of a file
As a preface, I do not have any experience in reverse engineering. I am an application developer, so this field is way out of my area of expertise. My end goal is to create a web page out of this ...
2
votes
1answer
276 views
How to extract information from a binary file knowing the target info
I have some measured data comes from a various types of sensors. The sensors are connected to a data-logger in order to store measurement data. After measurement, the data transported and stored in a ...
0
votes
2answers
89 views
How does an executable’s static API differ from it’s dynamic API?
Running an executable in Cuckoo sandbox gives me its dynamic API information. How do these API calls differ from their static API information (eg. If I were to just put the executable through IDA Pro ...
