Questions tagged [binary-analysis]

The process of gathering information about a binary file, either with static or dynamic methods.

Filter by
Sorted by
Tagged with
0 votes
0 answers
37 views

Dynamic analysis of cmd dependent software

There is a PE file, which can't run by itself, and can only be called from cmd.exe, it doesn't create independent processes, and can be launched independently only with .bat scripts, which without &...
flying_meatball's user avatar
0 votes
1 answer
55 views

Offset addressing

I’m writing a C-SKY (CK803S) processor module for IDA Pro, and a question arose about offsets in transitions, small ones are fine, but long ones lead to nowhere, from the documentation: in code I ...
Andynvkz's user avatar
1 vote
0 answers
38 views

Potential vulnerabilities in a binary run as root

I am given a vulnerable 64-bit stripped application, it conducts basic password strength checks on linux(/etc/shadow). The application receives workers(which creates worker process for performing the ...
emotional_piper's user avatar
0 votes
0 answers
52 views

Help determine 3d model vertex structure serialized binary

Help determine 3D model vertex structure serialized binary. Example of single vertex: A3 D0 5D BA C9 27 3F 3A DC 6C 87 3B 2B 75 EE 00 FF FF FF FF 92 2F 29 80 B1 19 64 3F 02 82 1D 3F What I got so far:...
S4TURN's user avatar
  • 1
0 votes
0 answers
60 views

Help Extracting a CramFS filesystem from .img binary

I'm trying to extract a CramFS filesystem from a firmware binary for the FVS318Gv2. It downloads as a .zip file that can be decompressed to reveal a firmware .img file and a readme.htm. Running ...
cdbrunow's user avatar
0 votes
0 answers
64 views

Decompile or analyse injected /usr/bin/cat

I'm trying to decompile or analyse an injected Linux executable binary file /usr/bin/cat ,and find the injected code as a readable. Need some tips as a beginner how to find the injection method if it'...
Dany Burgos's user avatar
0 votes
0 answers
43 views

Unknown Mitsubishi automotive MCUs - are these using unknown architecture?

Please help ientify the architecture (ISA) of MH8200F and MH8110F which is found almost exclusively on Mazda ECUs with L3CK, L587, L5E8, LFAR, LFFR, LFJP firmwares I've revealed that the MH8501F is ...
Andy's user avatar
  • 1
1 vote
1 answer
120 views

VxWorks flat binary file

VxWorks has a "flat binary file" format in which the initial 8 byte values are 45 53 54 46 42 49 4E 52 (ESTFBINR if interpreted as ASCII). I know very little about their content except: ...
g1l1t1's user avatar
  • 31
0 votes
0 answers
460 views

Hello Watch 3+ smart watch firmware extracting

I have a firmware file of Hello Watch 3+ smart watch. I want to customize this firmware. I tried binwalk but no result. I am trying reverse engineering for the first time. Can you help me? File link: ...
Eray Eser's user avatar
0 votes
0 answers
67 views

Requesting Guidance To Understand SuperScape's .VCA Format: Lego Creator Knights Kingdom

I hope you all are doing well and staying safe. I am in the process of trying to understand how SuperScape stored data in their .VCA/LCA format, so I can extract the original SHAP and PAL data from ...
amoebame's user avatar
1 vote
0 answers
151 views

Analyse a statically linked binary and extract syscall from it using angr

How to extract all syscalls from analysing a statically linked binary. I have a script written using angr(Latest - v9.2.78) but when I start my script I get few syscalls and the analysis is like hung ...
0x4E4F4F42's user avatar
0 votes
0 answers
31 views

Why can't I resolve the 'system' dynamic addresss in ret_2_libc exploit?

First and foremost, I am a noob pwner. The problem at hand is from TryHackMe.com > pwn101 > pwn109. A simple ret_2_libc in which you exploit a simple buffer overflow, leak the addresses of gets()...
Christian Sanchez's user avatar
1 vote
0 answers
31 views

Old Windows CE 5.0 device image repair

I need to repair an old industrial device, based on Intel XScale PXA255 and Windows CE 5.0. It has a bootloader on NOR Flash and OS image and filesystem partitions on NAND. I've disassembled ...
N1X's user avatar
  • 11
0 votes
0 answers
27 views

Why would unreadable data recovered from a drive be non-recoverable?

I ran Disk Drill on a drive that was a member in a failed software RAID mirror on macOS. The drive seemed to be fine, but was showing up as "uninitialised", so the drive didn't fail as such ...
Iain Dooley's user avatar
0 votes
0 answers
195 views

Need Help Cracking a Program

So I've got this .exe that I want to crack. It's an old management system for people in truck loading business. I kind of understand what's happening with window API calls but I'm unable to access the ...
The one word assaulter's user avatar
0 votes
0 answers
257 views

Need help in opening of binary files

Need help with unreadable Far Cry 6 binary format (.spx) Hi everyone, name is Adi :-). For the past few weeks I've been searching for a solution to a problem that the Far Cry Modding Community with me ...
Adi_B_M's user avatar
1 vote
0 answers
42 views

Retrieve functionality to button - game patching

I'm patching an old game, and I want the retrieve the toggle fullscreen functionality it's supposed to have. In the menu, in the display tab, there is a disabled option of fullscreen mode that you can ...
Yair Derry's user avatar
2 votes
2 answers
2k views

UPX Unpacking tool

Firstly, thank you for your answer. What is the best unpacking tool to use to unpack - UPX 0.89.6 - 1.02 / 1.05 - 1.24 ->[Overlay] could you please provide a link so i can obtain as such. Thank ...
Alan's user avatar
  • 21
2 votes
2 answers
252 views

How can I find the buffer of CryptGenRandom?

I am trying to analyze the CryptGenRandom algorithm on my Windows 10 laptop. According to Niels Ferguson's Whitepaper called 'The Windows 10 random number generation infrastructure', the ...
Riemann's user avatar
  • 83
0 votes
1 answer
210 views

How to pass an SVD file as an argument to IDA Pro in the command line (batch mode)?

I am trying to disassemble a few Arm Cortex-M3 .elf binaries and run a custom IDAPython script (script.py) from the command line (in batch mode). I have been able to do that with the following command:...
Konstantinos's user avatar
0 votes
0 answers
99 views

How do I properly decode the .bin files (RLE compression)? (DOS game - 1988)

Does anyone know what tools should I use to extract the backgrounds and sprites of this very rare old game: Armorik the Viking? The files are in .BIN format. Compression is RLE The game is from 1988 ...
The Thinker's user avatar
2 votes
2 answers
126 views

Determine Endianess of some ARM binary image?

I have been advised to analyze an ARM binary image from an Cortex M3 (STM32) for training. It has been directly extracted from flash beforehand and passed to me. However it's unknown whether this ...
Tomblarom's user avatar
  • 121
1 vote
0 answers
99 views

angr - project.loader.find_symbol("main") does not works

I have very simple C code - compiled on MSVC using clang++ compiler. When I am running it under angr environment - it simply does not finds main() function, while it can do so for other things like ...
ultimate cause's user avatar
3 votes
1 answer
561 views

How to reverse Engineer a Struct in IDA Pro?

How to identify and define a struct in IDA pro Decompiling during reverse engineering? Please explain the easiest way to figure out the struct in IDA Pro decompilation! To make life easier are there ...
Jose I. Hughes's user avatar
2 votes
0 answers
659 views

Please help identify which type of CPU architecture is used on obscure portable media players

I am trying to reverse engineer a media player with obscure SigmaTel SoCs just for fun but I didn't find very useful information. As far as I don't know exactly what CPU architecture is used on these ...
Andy's user avatar
  • 21
3 votes
1 answer
137 views

What type of bin is this file?

Can someone help me what type of BIN file is that and can i read what is inside ? Thanks https://easyupload.io/673djh
johnz's user avatar
  • 31
3 votes
0 answers
218 views

PEStudio DLL analysis: flag in export section

I start to use PEStudio for DLL analysis; I understand (more or less) everything, except the "exports (flag)" section: What does it mean the X in the flag column? So, what is a/the flag? ...
Gianluca's user avatar
  • 131
1 vote
0 answers
223 views

Get all names of functions from an iOS-App binary (headless)

Setup: I want to get a list of all (apple built-in) function and variable names that are used in an arbitrary iOS App by headless analysis. So given the .ipa file of any iOS-App, I unpack it and can ...
Kühlhausvogel's user avatar
4 votes
1 answer
139 views

💻 This code does not crash on ARM (qemu). Why?

I found a couple of interesting integer underflows leading to memcpy() wild copies in a TLV parser process of some random IoT firmware. It is 32-bit ARMv7. I'm able to emulate the userspace process ...
Attila Szász's user avatar
4 votes
1 answer
188 views

Mickey Mouse toy bin file analysis

I am trying to reverse engineer a Mickey Mouse toy just for fun but I am stuck. The toy has several buttons that play various phrases and songs. My aim was to see if I can read those songs from the ...
George Farcas's user avatar
4 votes
0 answers
196 views

How to assemble back a disassembled Linux kernel?

I have a Linux kernel file and I need to tweak the contents of its corresponding initramfs. I did it in the past for standard distros where kernel and initramfs were separate. However, this specific ...
Peter's user avatar
  • 141
3 votes
1 answer
61 views

GNU strings with --encoding=S

I have two binaries. Both contain the string "precondition failed" (without the quotes). The corresponding byte sequence 70 72 65 63 6C 65 64 00 is the same for both binaries. However, the ...
langlauf.io's user avatar
  • 1,560
2 votes
2 answers
94 views

Decoding a list of integer values in unknown format

I'm attempting to reverse engineer a binary file format which is used to encode a list of integer values. I can't work out how this format works, as the number of bytes used to encode each value ...
ndawson's user avatar
  • 73
2 votes
0 answers
67 views

Buffer overflow gets() weird parsing

I'm attempting to do a buffer overflow with gets(). I've figured out how to write over the return address and I'm able to do so, however, I cannot write in the address I need because the 0x7F at the ...
user42774's user avatar
3 votes
0 answers
67 views

How can I quickly tell which ARM Thumb version a particular piece of code is using?

I'm working with an ARM processor: an STM32F407VGT6 board, which IIUC powers a 32-bit Arm® Cortex®-M4. I need to inspect the binary weight of some instruction, so I used objdump like this: arm-none-...
Alessandro Bertulli's user avatar
3 votes
1 answer
879 views

U-boot base address on Ghidra

I'm trying to do some REing on a vendored U-Boot bootloader image. For context, the U-Boot image was extracted from the full firmware image with: dd if=<firmware>.img of=uboot_sdcard.bin bs=1024 ...
Rui Oliveira's user avatar
2 votes
0 answers
39 views

Find out what is this binary database entry and what format it is

the following varbinary "BUFFER" of a database entry is for an article. FIELD_0 is in plain text and the item name is "1", which I created with the item management software. [...
Chrischi's user avatar
2 votes
0 answers
56 views

How to obtain import name from disassembled assembly

I'm trying to create my own tools for reverse engineering PE. I have some assembly codes that I fetched from a clone of objdump for a program. Sometimes I see call instructions such as : callq *...
onerom's user avatar
  • 21
2 votes
1 answer
761 views

Trying to reverse a bin file

I'm trying to reverser a bin file with Ghidra, without success for the moment, I can't find any functions in the decompiled file. he bin file is for an ARM 32bits, I'm pretty sure this is an stm32, so ...
simon's user avatar
  • 131
0 votes
1 answer
407 views

Which tools are available to see embedded image and sound data

I'm reverse engineering a program from a memory dump using Ghidra. I know there are sections which contain images and sampled sound data in a raw format. I'm looking for a tool which will let me view ...
Robin Elvin's user avatar
2 votes
0 answers
47 views

How to get the APIs present in a particular block in a CFG using Angr?

I'm doing binary analysis based on Control Flow Graph (CFG). As I suppose to get the APIs from every block in the CFG. I'm finding it very difficult to do so using Angr as I don't have enough grip on ...
okokok hack's user avatar
1 vote
1 answer
679 views

Reverse Engineering Go obfuscated binaries

I have been trying to understand the working of this go malware by reversing it, which can be found here , so basically this stuff takes a shellcode as an input, and converts it to an exe or dll file, ...
Subhajeet 's user avatar
1 vote
1 answer
57 views

How to know each register value instruction by instruction in a binary using radare2?

As I am using the radare2 for reverse engineering, I find it very difficult to get all the register values instruction by instruction with the help of the Radare2 tool. Could someone please help me to ...
okokok hack's user avatar
2 votes
0 answers
47 views

LZ4N file format - file decoding

I'm trying to decode a file that is part of device firmware. Unfortunately it comes RIFF<...>WAV format wrapped / packed with strange LZ4-like format. Non of linux available lz4 tools do ...
Krystian's user avatar
2 votes
0 answers
695 views

Firmware Binary Reverse with Ghidra returns only few codelines decompiled with truncated code

I have tried to decompile the firmware binary of a microcontroller that should be an STM32 (but I'm not sure about this). After the analysis I get only few codelines with a lot of similar messages: ...
AndreaF's user avatar
  • 121
0 votes
1 answer
179 views

Reversing encrypted file with unknown extension

Hello to everyone in RE section! I have a binary file with questionable extension(meaning idk if its exe/dll). Multiple variations of this file can be acquired throught connection to remote CDN via ...
Roman Avdeenko's user avatar
1 vote
1 answer
107 views

Under what circumstances relative to instr rip+offsets to .rdata data may not match?

I have a 100Mb binary file, in which I need to find and patch specific bytes in a function. When disassembled in IDA, this function is the only thing that ever references on unique ASCII string via ...
Digika's user avatar
  • 53
3 votes
0 answers
516 views

Reverse-engineering the Sony Camset (Camera Settings) file format

Context Newer Sony cameras have functionality that allows them to: save the current camera settings (shooting mode, auto-focus mode, etc.) to a file load the camera settings from a file into the ...
Raleigh L.'s user avatar
3 votes
0 answers
960 views

Find constant variables with float values using Ghidra

I dumped an il2cpp.so with il2cppDumper and in the dump.cs I found that the variables I wanted to change its values are somewhat constant float. this is the snippet: // Namespace: public class ...
hanan's user avatar
  • 309
2 votes
0 answers
84 views

jump to invalid address when emulating

I am currently working on a deobfuscation tool for a Windows Driver (which is obfuscated). I am using Capstone to disassemble and Unicorn to emulate. I have run into a weird issue where the indirect ...
Ayyware's user avatar
  • 41

1
2 3 4 5
11