Questions tagged [binary-analysis]

The process of gathering information about a binary file, either with static or dynamic methods.

Filter by
Sorted by
Tagged with
0 votes
1 answer
22 views

ida jumping to address I can't see in driver

When I open this driver in IDA i can't seem to see the instructions that this jmp at 0x1400DC46D jumps to. I've tried to undefine bytes and re-analyze the function but it then ends up will garbage. ...
user avatar
0 votes
0 answers
298 views

Extracting ZTE F670L router's config.bin file

I want to enable telnet in my router (ZTE F670L V9.0.11P1N20D), So, I backup my router and i have a file config.bin, Size 23.5KB. I fired up kali and when i issue this command: $ file config.bin ...
user avatar
1 vote
1 answer
72 views

Ida cannot open. a files of esp32 (Xtensa)

I tried to open this file with IDA Pro https://github.com/espressif/esp32-wifi-lib/blob/master/esp32/libpp.a Ida detect that is ELF for Xtensa (relocatable) But when I tired to open it I got Undefined ...
user avatar
0 votes
1 answer
105 views

Changing the jne to je instruction causes program to generate error

I'm trying to change the instruction from jne to je I've change an instruction 75 0c jne [some_location] 75 0c is a 2 jump instruction. So, I've a chaged it to from 75 0c to 74 0c which is ...
user avatar
0 votes
1 answer
31 views

ROP: System function not printing results to stdout

in oder to solve a CTF-Challenge I have to construct a small ROP-chain. The scope of the ROP chain is to print the content of the `flag` file. I already constructed the ROP-chain, but it seems that ...
user avatar
0 votes
0 answers
25 views

Radare2 only printing out the last byte at RSP when using pxq @ rsp

According to documentation, px[?][owq] [len]    hexdump of N bytes (o=octal, w=32bit, q=64bit) and pr[?][glx] [len]    print N raw bytes (in lines or hexblocks, 'g'unzip) These two ...
user avatar
0 votes
0 answers
59 views

Extending Razer Synapse "Turbo-click" keybind past current restricted values?

I know this might sound dumb but as a little challenge, I would like to reverse engineer the Razer Synapse binary and change the current max "Turbo" (auto-click) mode to extend beyond the ...
user avatar
0 votes
0 answers
74 views

Unpack Fortinet VM upgrade package

I am researching FortiGate. Fortinet provide ovf files of their products to deploy in VMware, they also provide upgrade package with name ending with ".out", which can be uploaded to VM ...
user avatar
0 votes
0 answers
190 views

How to extract the underlying XML structure of the SIEMENS NX .part files

I am trying to understand the underlying structure of SIEMENS NX .part files. I expect to find some sort of structural markup language (e.g., XML) that defines the CAD. You may download example .part ...
user avatar
  • 159
1 vote
0 answers
30 views

nrf52-based localization tag flash dump and modification

Lately I've bought a localisation tag (Apple AirTag alike). When I click a button on my cell phone, the device plays a chiptune-like ringtone. The ringtone is configurable using the app and stored on ...
user avatar
  • 11
0 votes
0 answers
50 views

ida shows instructions as hex data

I am new to reverse engineering. I did a couple of projects. now I was doing another project and faced kind of a problem. at the start of the program, there is a label that points to an address of ...
user avatar
0 votes
0 answers
19 views

How to decomple unmanaged .net assembly loaded and invoked via System.Reflection.Assembly interface?

Is there any tool to decomple unmanaged .net assembly loaded and invoked via System.Reflection.Assembly interface? example code: [UnmanagedFunctionPointer(CallingConvention.StdCall)] delegate void ...
user avatar
0 votes
0 answers
21 views

Binwalk, what's advantage of "Show results marked as invalid"?

I'm trying to understand -I option in binwalk. It provides some interesting output yet it isn't clear if these results are "invalid" or if they are valid results of a special type. DECIMAL ...
user avatar
  • 123
1 vote
0 answers
64 views

Extracting Binary Stream inside an mp3

In the song Chisel by Pruient there seems to be what sounds like a binary octet stream starting at 4:43. The section of noise has distinct sections punctuated with momentary silence which leads me to ...
user avatar
0 votes
1 answer
670 views

How to exploit __isoc99_scanf with a segmentation fault

I'm an absolute newbie when it comes to all this side of reverse engineering. Each time I try and understand it, I get lost almost immediately. I am trying a lab. I open it up in Binary Ninja. I get ...
user avatar
  • 221
1 vote
1 answer
120 views

How to call a func in an executable binary?

I have a binary with a func that I can disassemble. What are simple ways for me to call it with arbitrary args and observe its return val and behavior? Ideally, I'd like to do this: Within gdb (or ...
user avatar
0 votes
0 answers
97 views

Reverse engineering STM32F303 firmware udpate

I have an .exe file, which connects via USB to a STM32F303 peripheral with unknown firmware. The .exe is able to update the STM32 firmware via the USB. The firmware update is also provided, and its ...
user avatar
  • 21
1 vote
1 answer
154 views

Binary diff + patching across versions

What are the current options for binary patching which works across different versions of the binary? E.g. we created a binary patch for a specific version of a binary and want to apply that patch to ...
user avatar
1 vote
1 answer
82 views

What is data only exploitation?

I was wondering, and after trying to read for the past several months I got totally lost and don't understand this concept. Could someone please explain in simple words the concept of data only ...
user avatar
  • 11
2 votes
1 answer
79 views

When would a program normally transfer data between memory and coprocessor?

In the analysis of an ARM binary, when would one normally encounter transfer operations between memory and a coprocessor? These are encoded as the LDC and STC operators. Would it be common for ...
user avatar
  • 123
0 votes
0 answers
67 views

How do I view registers at a specific point of a binary's execution?

I have a binary that I'm attempting to reverse engineer to find a flag. From using ghidra I have found that the flag is stored in the program at a point called "check" and then run through ...
user avatar
0 votes
0 answers
122 views

Extract smartwatch firmware bin file

I'm trying to extract files from a bin file that's the firmware of a smartwatch. I tried using binwalk -Mre firmware.bin but got no files, this is the result: How should I extract/modify this bin ...
user avatar
1 vote
2 answers
296 views

Can't figure out a crash in IDA "The memory could not be read -> 00000710 (exc.code c0000005, tid 20612)"

I'm trying to debug out a game. Basically, the Steam version works perfectly but the GOG version (which is 8kb smaller) has an annoying problem where for some people (which happen to be me) the game ...
user avatar
2 votes
1 answer
158 views

Proprietary 3D Format Reverse Engineering: What Could These Numbers And Matrices Represent?

I'm trying to reverse engineer a model format from an older Russian game (Pathologic) with limited success. It is a proprietary model format not recognized by any converters/editing tools (believe me, ...
user avatar
  • 21
0 votes
1 answer
63 views

string pointer to byte conversion condition

I am trying to understand the following snippet. I understand that the first check would check if it is even if it would be an int, but I don't understand it in this context. Could someone explain to ...
user avatar
  • 3
0 votes
0 answers
63 views

How to debug an unknown Tricore binary

I want to analyze a binary from a automotive ECU with an Infineon TC1797 Tricore processor. I can load it in Ghidra, and have analyzed and reverse-engineered a bit of code at the starting address. I ...
user avatar
  • 1
1 vote
0 answers
75 views

Unknown binary format (.scp) - No Header

I hope everyone is doing well. I've recently been trying to decode the structure of some files that contain a lot Unicode-8 IIRC characters, with a mix of binary. When I put it into IDA, I can't seem ...
user avatar
  • 11
1 vote
0 answers
38 views

How to find references for a string (where it is being called) in Go binary

I have a Go binary and I have this string: When I go to its location, with IDA Pro, and tries to find all the references (using x) I am getting a message that there are no references: It might be ...
user avatar
  • 451
2 votes
1 answer
167 views

Reverse engineering Roland TR-8S kit file format .t8k

I'm trying to figure out the file format that the Roland TR-8S drum machine uses for importing/exporting drum kits. My goal is to replace the sample (PCM) data within a kit. It's a proprietary binary ...
user avatar
0 votes
0 answers
357 views

Extracting Userdata from Userdata.bin file backup of oneplus 7pro mobile

I have userdata backup file (Userdata.bin) of oneplus 7pro. I want to extract photos and videos from this. when i used the command "binwalk userdata.bin" it shows DECIMAL HEXADECIMAL ...
user avatar
  • 1
1 vote
0 answers
310 views

Repacking vmlinux into zImage/bzimage

While RE an embedded device I ran into a problem - I need to patch a check in the kernel which has no sources available. Unpacking the kernel and binary-patching went smoothly. However I cannot get ...
user avatar
  • 153
1 vote
2 answers
476 views

Is it possible to reverse CGI binary file?

I wanna reverse CGI binary file. Is it possible? What are the recommended tools and guides? Thank you for reading my question. $ file test.cgi status.cgi: ELF 32-bit LSB executable, ARM, EABI5 ...
user avatar
2 votes
1 answer
68 views

Reversing uboot on an aarch64 Hi3559AV target problems

I am trying to reverse uboot for an ARM aarch64 Hi3559AV target. I've dumped the binary uboot.bin.gz, and have loaded it in IDA at the correct address. IDA seems to see a lot of strings (and ...
user avatar
  • 41
0 votes
2 answers
181 views

Open unknown image format (probably a RAW image)

I copy image files here from a linux based system which ends with .bin. Unfortunately I don't know how to open it. The goal is to convert images to this format later. What I have already tried: Open ...
user avatar
  • 73
0 votes
1 answer
75 views

What character codes could these be?

Good day. I have these character codes in a binary file (Adobe After Effects Project) that represent a string. If I change them the text inside the application changes. However, for the life of me, I ...
user avatar
0 votes
1 answer
169 views

How to get the input necessary to get to the end

In short, I have a code that gets an input via stdin. Once it has the input string in memory, it verifies its integrity by calling a function for every condition, and exiting the program if those ...
user avatar
1 vote
0 answers
134 views

Nokia 105(TA-1114) Firmware analysis using Binwalk

First please forgive me if a make any mistake. i am not a primarily English speaker but I will try my best. Few days ago i started to tinkering with Nokia feature phone Nokia 105(TA-1114). I get a ...
user avatar
-1 votes
1 answer
130 views

Instrument memory accesses of python scripts

My research requires processing memory traces of applications. For C/C++ programs, this is easy using Intel's PIN library. However, as suggested here https://stackoverflow.com/questions/51835532/use-...
user avatar
2 votes
0 answers
94 views

How to modify checksum after making changes in Nokia 215 4G firmware?

If I change any character in the firmware file and try to flash it, it will failed. But it will successfully flashed if I changed the string with the same number of character if it's not a function. ...
user avatar
  • 21
1 vote
0 answers
106 views

What type of file has the file signature 'BOOT'?

I have a .bin file which I am trying to disassemble into something that I can edit. Given that binary files can contain just about any binary data, I found it difficult to assess what file data is ...
user avatar
  • 61
0 votes
1 answer
42 views

The Logic Of Incremental Data on Serial Communication Encoding

These are the serial communication reverse values. I am trying to understand the logic behind this. I am pretty sure that 2 bytes represent 1 byte(high byte and low byte), values are correct. I tried ...
user avatar
1 vote
1 answer
163 views

Arrays assembly

I'm reversing my C array's programs where I'm storing numbers in arrays like this... int marks[5]; marks[0] = 1; marks[1] = 3; marks[2] = 2; marks[3] = 7; marks[4] = 9; so the compiler showing me the ...
user avatar
0 votes
1 answer
89 views

Why compiler is doing this?

While I was disassembling my own C code for practice I saw an interesting point which I want to share with you guys and needs to know the answer as I always get from here. Now, the interesting point ...
user avatar
0 votes
0 answers
80 views

How to Find Password/ Bypass Password in a Switch Statement using IDA

I'm new to reverse engineering, wondering how access or bypass the password contained in the switch statement ? File Link
user avatar
  • 1
2 votes
1 answer
203 views

Not able to understand the C-switch statement in disassembly

While I'm trying to disassemble my own C code I am stuck in a problem of not understanding how this Switch statement is implemented in assembly code. Can anyone please help to figure it out? This the ...
user avatar
0 votes
0 answers
41 views

IDAPython NtCreateFile

Let's say I want to print the filenames on every call to NtCreateFile (With %any% exe loaded in IDA ) The first problem is to get the ntdll!NtCreateFile address Tried to do it like this ...
user avatar
  • 1
12 votes
4 answers
5k views

Why do reversers nowadays reverse engineer using decompilers and not disassemblers?

I see many reverse engineering lessons and every second person does reverse engineer using Ghidra decompiler and not disassembler as both are available in the same platform. I assume that reversing ...
user avatar
0 votes
0 answers
81 views

finding a not-so-straightforward game's function

I am working on Mad Max game [ APEX engine ] I do my best to explain the situation. so my target executes function like this: there are commands like " call [eax+XX] " or " call RX &...
user avatar
  • 11
0 votes
1 answer
40 views

How to force a program to run as monothread for dynamic analysis?

I'm reversing a program with x64dbg and ida (I switched from ghidra), hence disassembled and decompiled, I need to understand what is happening with dynamic analysis, but I have a tricky part where ...
user avatar
  • 123
3 votes
2 answers
106 views

How to figure out functionality when doing Static Code Analysis in ASM?

When doing Static code analysis on a disassembled app, I usually end up seeing many calls to registers (CALL EAX for example), which is constructed in runtime, which leaves me clueless on how to ...
user avatar

1
2 3 4 5
11