Questions tagged [binary-analysis]
The process of gathering information about a binary file, either with static or dynamic methods.
2
votes
2answers
115 views
Unable to extract IP camera firmware
I am trying to extract the firmware for a Panasonic WV-S2131L ip camera. It comes as a .zip file that contains a .img file. I have tried many methods to try to analyze this file and I have found ...
1
vote
0answers
33 views
How to find the index of static ilbrary functions in the PLT of the binary?
So right now I'm trying to resolve function calls and their names in my reversing tool
the problem I'm having is that library functions such as printf and fwrite and such do not have a corresponding ...
0
votes
1answer
53 views
What type of function gets called using a register instead of address in the binary? how to find the address statically?
So I'm trying to write a reversing tool right now and trying to make a CALL graph
the problem I'm having is some calls are like Call *eax instead Call 'address'
I can easily generate the call-graph ...
0
votes
1answer
66 views
How to split ARM code/data from binary in Inmarsat Isatphone Pro?
I'm analyzing the 3 binaries for updating firmware to the Inmarsat Isatphone Pro phone. Additionally, I'm following the Groundworks Technologies paper, and attempting to recreate their work as a ...
0
votes
1answer
24 views
me_cleaner and fwupd, or manipulating UEFI .cab files
I'd like to extract a plain dump of the UEFI firmware of my laptop (1:1 copy of the flash content, often called .bin or .rom files) from the .cap file, so that I can modify it slightly with me_cleaner....
4
votes
1answer
84 views
Can I define custom enum-type to be used in Ghidra as a data type?
I'm trying to learn Ghidra. Say, if it generated the following code for loading functions from an array of function names from gpfnCommCtrlAPI:
I was able to retype gpfnCommCtrlAPI into char*[14] ...
0
votes
1answer
41 views
Best python framework/library for constructing the call-graph from binary?
So i have written a python tool using capstone that disassembles the code section of a ELF binary using capstone.
now i want to also create and show the call-graph of this binary in a dot format, I ...
1
vote
1answer
38 views
View Array Type in dnSpy
I'm debugging a .NET application and see a declaration of a local array:
$ArrayType$$$BY05PAD $ArrayType$$$BY05PAD;
I break on an instruction that uses data inside that (char*) array:
num9 = <...
0
votes
0answers
57 views
How to securely implement a heartbeat in anti-cheating?
I'm building a generic anti-cheating solution in Golang. I plan on implementing a heartbeat for remotely verifying it's still running. How would I go about implementing this in a secure fashion, so ...
2
votes
0answers
163 views
How to load symbols from a symbol server in Ghidra?
I've been trying to learn Ghidra by attempting to reverse the comctl32.dll system library, which has many of its functions documented. I started the de-compilation analysis in it, and after a while it ...
1
vote
1answer
93 views
Decryption loops
I'm reversing a CTF binary and I found a decryption loop decompiled by IDA like this:
for ( i = 0; i < n; ++i )
{
v22 = *((_BYTE *)sub_5657D89B + i);
v0 = v22 ^ 0x90;
v1 = strlen(&...
1
vote
0answers
32 views
How do I decode arbitrary data from a raw extracted binary?
I have a IoT scale that stores my measurements into records and passes them onto my phone. I was able to read directly off a flash chip and create a binary file. The chipset is ARMv7.
I want to be ...
0
votes
0answers
46 views
Vulnerabilities of Binary executed by root
I was given a vulnerable 64bit dynamically linked stripped that runs simple checks to determine the strength of the passwords of users on a linux system.
The app checks if it the EUID is 0 and then ...
0
votes
1answer
60 views
x86-64 CALL opcode + disassembly
Working a basic buffer overflow on a 64bit system and putting together some basic shellcode. The main program does a call to puts@plt. When I disassemble main in gdb, the opcodes show as:
e8 6b fe ff ...
1
vote
0answers
58 views
Can anyone make much sense of this binary for an embedded system? [closed]
I want to see if anyone more experienced in reverse engineering and disassembly can take a look at this binary update file I have and maby ether help or just say if it is even possible to reverse it.
...
1
vote
1answer
101 views
Does a symbolic disassembler exist?
I would like to know if there are disassemblers based on a symbolic analysis, I'm beginner in RE, but I think that a disassembler based on symbolic techniques can be very interesting and could ...
0
votes
0answers
60 views
What is this function doing?
I have this function, named __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6__initEPKcm.
And this is the relevant assembly:
mov rdi, [rbp+var_A80]
mov rsi, [rbp+var_A88]
...
1
vote
0answers
64 views
REing GameCube model (GCR) and texture (GCT) formats
I'm attempting to reverse engineer the mesh and texture formats used by the 2005 GameCube game "TimeSplitters: Future Perfect". Unfortunately, I'm not nearly good enough at this kind of thing to ...
1
vote
1answer
70 views
When can trapping be used?
This is the beginning of one of the functions inside NTDLL of Windows XP:
MOV EDI,EDI
PUSH EBP
MOV EBP,ESP
...
The book on reverse engineering I am reading(Eldad Eilam - Reversing: Secrets of ...
1
vote
0answers
53 views
Argument types not identified when parsing declarations
I'm trying to add a dynamic import segment in the IDA database which contains functions names, and I'm applying type information to it, so that I can obtain argument locations by using ...
1
vote
2answers
58 views
Calculation with not defined variables?
I am new to reverse engineering and try to solve a crackme with radare2.
My problem is understanding of the following lines:
| 0x000007a9 c745b8000000. mov dword [var_48h], 0
| ...
2
votes
1answer
220 views
Extract a secret from an Android apk or .so file
Context
As an exercise I am researching all methods of hiding a secret in an android mobile app binary... Yes I know that with more or less effort they can always be extracted with static analyses, ...
0
votes
0answers
37 views
Will an iOS app (IPA) that requires a login work if I repack it and install it on the device?
I downloaded iOS WhatsApp from App Store, decrypted the binary, repacked it, and installed it back onto the device (deleting the app before installing). When I opened it, it only showed me a blank ...
0
votes
1answer
300 views
How to print the value of register with Radare 2
I am trying to solve this ELF - Ptrace challenge. I use Radare 2. This is the commands I execute to print the assembly code.
radare2 ch3.bin
[0x080482f0]> aaa
[[anal.jmptbl] Missing cjmp bb in ...
2
votes
1answer
87 views
Radare2 does not display the entire assembler code
I am trying to solve this ELF - Ptrace crack me. Here are the commands I use :
I start radare2 with the crack me as argument.
radare2 ch3.bin
I decide to go to the main and print the assembly code ...
0
votes
1answer
71 views
Combine various sub routines into one sub routine (IDA Pro)
Currently I am analyzing a .so file and there is a function which is supposed to be large (high number of nodes and edges). However, IDA Pro identified it as a small function, with various parts of ...
1
vote
2answers
125 views
Emotet invoice, what is the embedded file inside the word document
This pastebin hosts current URLs hosting the fake invoice of Emotet malware, which is the dropper part of the malware.
The document is a Office Open XML, and there are two large non textual segments ...
-1
votes
2answers
314 views
XOR encryption - How to find the key?
I'm trying to solve a crackme which basically uses a XOR encryption scheme in which the password is used as the key to an encrypted buffer which is subsequently executed. The following is the ...
1
vote
0answers
50 views
How can a segfault happen during the libc exit call on Linux?
I'm relatively new to reverse engineering, and I've decided to practise using the challenges from pwnable.tw. Currently, I am working on the "Silver Bullet" challenge.
While testing, I have noticed ...
2
votes
1answer
106 views
ROP chain: Buffer Overflow Return Pointer
I am trying to get a ROP exploit to work on Ubuntu 18.04 LTS 64bit.
I have a 64 bit binary (Nx enabled, ASLR disabled) with vuln function as follows:
public vuln
vuln proc near
var_100= byte ptr -...
1
vote
1answer
62 views
IDA - large jump table, missing cases in analysis
I have come across the following jump table with a large amount of cases (160+). There seems to be cases missing from IDAs analysis though. For example it skips from cases 22 -> 38 -> 91, and I can ...
0
votes
1answer
67 views
rip adress not visible with dr command
I just finished this challenge. This is the content of main function :
[0x08048a86]> pdf
/ (fcn) main 417
| main (int argc, char **argv, char **envp);
| ; var int local_16h @ ebp-0x16
|...
2
votes
1answer
65 views
Debug point not hit with radare2
I am doing this reverse engenering challenge. I executed theses commands to analyse the main function :
radare2.exe ch15.exe
aaa
s main
pdf
This is the output of the pdf command :
[0x004017b8]> ...
1
vote
2answers
144 views
Lots of mov instructions into ebp+offset - What is happening?
While learning RE I have come across this large segment of instructions that contains a majority of mov [ebp+offset], value instructions. I believe that ebp + offset are local variables? I think? ...
1
vote
1answer
203 views
How to reverse engineer a Black Box?
I am trying to reverse engineer / research a black box system, this is, a system for which there is no public information at all. Let's say the system is a modern handheld console.
I have already ...
0
votes
1answer
37 views
How to determine number and/or boundaries of linked object files in a PE generated by Visual Studio 6?
In this analysis of a Portable Executable linked using Microsoft Linker (6.0), down in the Imported Objects section, the website makes some very specific claims:
3 .OBJ Files (COFF) linked with LINK....
1
vote
1answer
58 views
What are those instructions doing?
I'm having a hard time figuring out whatever the hell this is doing.
mov rax, [rbp+var_720]
mov [rbp+var_458], rax
mov rax, [rbp+var_458]
mov [rbp+command_], rax
mov rax, [rbp+...
0
votes
1answer
86 views
How do I interpret the mangled functions name?
I am going to start by saying that this is my fourth attempt at reverse engineering a crackme and I'm starting to understand how assembly works, which is cool. I am sorry if this question is wrong or ...
0
votes
1answer
143 views
pwntools shellcode narnia2
I'm trying to solve the narnia2 challenge on overthewire.
I read a guide for help and managed to overwrite the stack with A's using some python
$(python -c "print 'A'*132 + '\xef\xbe\xad\xde'")
...
1
vote
1answer
315 views
Impossible to execute a program with radare2 : TO DO continue
I am trying to crack a crackme. I already catch the flag because I seen the string variable which represants flag. I would like to catch the flag on an other way, I want to set a breakpoint when there ...
0
votes
1answer
68 views
Why can't I decode this UART signal?
I have a modem that I'm trying to get into. It's composed of two SoCs, both with UART headers. I was already successful trying to connect to the first SoC's UART, with my USB-to-UART CP2102 decoder ...
1
vote
1answer
164 views
Analyze all functions with radare2
I have a big library in which IDA found ~84300 functions but using aa in radare2 I was just able to found ~3000.
I tried setting anal.hasnext to true, anal.from and anal.to to the start and the end ...
0
votes
2answers
257 views
Basic Blocks and Data Flow Analysis
I am looking to do some Data Flow Analysis via code. I have already the code that parses a binary and disassembles it (x86/x64) and creates Basic Blocks.
Now what I would like to do is, for any Basic ...
2
votes
1answer
47 views
obtaining string value from Unknown elf-x86-64 binary with gdb
I'm trying to find a string value stored in memory by a binary (possibly written in C) that won't show up when I perform "strings a.out". I have tried examining particular memory addresses of interest ...
4
votes
1answer
265 views
Reverse Engineering bios of ATM Machine
I bought an Hyosung NH1500 off Offer-up and it boots up and initializes some peripherals and then spits out and error of "COM download is failed". I've searched Google and 0 results came up, I've been ...
1
vote
1answer
376 views
How to convert Unexplored data in IDA Pro to code？
I am analyzing a malware, it has a lot of confusing methods, I wrote an idc script to remove confusion, use the MakeCode() function to convert some Unexplored data into code, but there are still some ...
1
vote
2answers
56 views
Getting a high level overview of comparative size differences of binary files?
I have two binary files, one of them is pulled from Protostar's (stack0 example). The other one I compiled (from source) with the latest version of GCC. The size difference is massive. My version is ...
-2
votes
2answers
511 views
Extract data from firmware (.bin) file which is compressed or encrypted
I have a firmware image of LCD TV that I want to research. Basically I want to customize RGB color settings (from source code), Logo of TV ... Is it possible? I binwalk to scan the file.
binwalk ...
1
vote
1answer
108 views
Reverse Engineering And Rendering Old Image Format .CEL
I want to reverse engineer titltext.cel .CEL image format and render this in SDL2.
I happen to know a little bit about the CEL file that I am working with. I know it is supposed to be a sprite-sheet ...
7
votes
2answers
324 views
Reverse engineering Windows Defender's signature for Metasploit Framework's metsrv.dll
As a pentester for a consulting agency, it is part of our job to "evade" antivirus after gaining code execution on information systems. It is indeed necessary to prove exploitation of vulnerabilities, ...
