Questions tagged [binary-analysis]
The process of gathering information about a binary file, either with static or dynamic methods.
539
questions
0
votes
0
answers
15
views
Hello Watch 3+ smart watch firmware extracting
I have a firmware file of Hello Watch 3+ smart watch. I want to customize this firmware. I tried binwalk but no result. I am trying reverse engineering for the first time. Can you help me?
$ binwalk -...
0
votes
0
answers
67
views
Hello Watch 3+ firmware extracting
I have a firmware file of Hello Watch 3+ smart watch. I want to customize this firmware. I tried binwalk but no result. I am trying reverse engineering for the first time. Can you help me?
$ binwalk -...
0
votes
0
answers
22
views
Requesting Guidance To Understand SuperScape's .VCA Format: Lego Creator Knights Kingdom
I hope you all are doing well and staying safe.
I am in the process of trying to understand how SuperScape stored data in their .VCA/LCA format, so I can extract the original SHAP and PAL data from ...
- 1
1
vote
0
answers
113
views
Analyse a statically linked binary and extract syscall from it using angr
How to extract all syscalls from analysing a statically linked binary.
I have a script written using angr(Latest - v9.2.78) but when I start my script I get few syscalls and the analysis is like hung ...
- 11
0
votes
0
answers
21
views
Why can't I resolve the 'system' dynamic addresss in ret_2_libc exploit?
First and foremost, I am a noob pwner. The problem at hand is from TryHackMe.com > pwn101 > pwn109. A simple ret_2_libc in which you exploit a simple buffer overflow, leak the addresses of gets()...
1
vote
0
answers
21
views
Old Windows CE 5.0 device image repair
I need to repair an old industrial device, based on Intel XScale PXA255 and Windows CE 5.0. It has a bootloader on NOR Flash and OS image and filesystem partitions on NAND. I've disassembled ...
- 11
0
votes
0
answers
24
views
Why would unreadable data recovered from a drive be non-recoverable?
I ran Disk Drill on a drive that was a member in a failed software RAID mirror on macOS. The drive seemed to be fine, but was showing up as "uninitialised", so the drive didn't fail as such ...
0
votes
0
answers
107
views
Need Help Cracking a Program
So I've got this .exe that I want to crack. It's an old management system for people in truck loading business.
I kind of understand what's happening with window API calls but I'm unable to access the ...
0
votes
0
answers
224
views
Need help in opening of binary files
Need help with unreadable Far Cry 6 binary format (.spx)
Hi everyone, name is Adi :-).
For the past few weeks I've been searching for a solution to a problem that the Far Cry Modding Community with me ...
- 1
1
vote
0
answers
30
views
Retrieve functionality to button - game patching
I'm patching an old game, and I want the retrieve the toggle fullscreen functionality it's supposed to have.
In the menu, in the display tab, there is a disabled option of fullscreen mode that you can ...
- 21
2
votes
2
answers
518
views
UPX Unpacking tool
Firstly, thank you for your answer.
What is the best unpacking tool to use to unpack - UPX 0.89.6 - 1.02 / 1.05 - 1.24 ->[Overlay] could you please provide a link so i can obtain as such.
Thank ...
- 21
2
votes
2
answers
218
views
How can I find the buffer of CryptGenRandom?
I am trying to analyze the CryptGenRandom algorithm on my Windows 10 laptop.
According to Niels Ferguson's Whitepaper called 'The Windows 10 random number generation infrastructure', the ...
- 83
0
votes
1
answer
99
views
How to pass an SVD file as an argument to IDA Pro in the command line (batch mode)?
I am trying to disassemble a few Arm Cortex-M3 .elf binaries and run a custom IDAPython script (script.py) from the command line (in batch mode). I have been able to do that with the following command:...
0
votes
0
answers
89
views
How do I properly decode the .bin files (RLE compression)? (DOS game - 1988)
Does anyone know what tools should I use to extract the backgrounds and sprites of this very rare old game: Armorik the Viking?
The files are in .BIN format. Compression is RLE
The game is from 1988 ...
2
votes
2
answers
101
views
Determine Endianess of some ARM binary image?
I have been advised to analyze an ARM binary image from an Cortex M3 (STM32) for training. It has been directly extracted from flash beforehand and passed to me. However it's unknown whether this ...
- 121
1
vote
0
answers
88
views
angr - project.loader.find_symbol("main") does not works
I have very simple C code - compiled on MSVC using clang++ compiler. When I am running it under angr environment - it simply does not finds main() function, while it can do so for other things like ...
- 121
3
votes
1
answer
359
views
How to reverse Engineer a Struct in IDA Pro?
How to identify and define a struct in IDA pro Decompiling during reverse engineering?
Please explain the easiest way to figure out the struct in IDA Pro decompilation!
To make life easier are there ...
2
votes
0
answers
647
views
Please help identify which type of CPU architecture is used on obscure portable media players
I am trying to reverse engineer a media player with obscure SigmaTel SoCs just for fun but I didn't find very useful information.
As far as I don't know exactly what CPU architecture is used on these ...
- 21
3
votes
1
answer
133
views
What type of bin is this file?
Can someone help me what type of BIN file is that and can i read what is inside ? Thanks
https://easyupload.io/673djh
- 31
3
votes
0
answers
156
views
PEStudio DLL analysis: flag in export section
I start to use PEStudio for DLL analysis; I understand (more or less) everything, except the "exports (flag)" section:
What does it mean the X in the flag column? So, what is a/the flag?
...
- 131
1
vote
0
answers
176
views
Get all names of functions from an iOS-App binary (headless)
Setup:
I want to get a list of all (apple built-in) function and variable names that are used in an arbitrary iOS App by headless analysis. So given the .ipa file of any iOS-App, I unpack it and can ...
4
votes
1
answer
134
views
💻 This code does not crash on ARM (qemu). Why?
I found a couple of interesting integer underflows leading to memcpy() wild copies in a TLV parser process of some random IoT firmware. It is 32-bit ARMv7.
I'm able to emulate the userspace process ...
- 61
4
votes
1
answer
173
views
Mickey Mouse toy bin file analysis
I am trying to reverse engineer a Mickey Mouse toy just for fun but I am stuck.
The toy has several buttons that play various phrases and songs.
My aim was to see if I can read those songs from the ...
4
votes
0
answers
163
views
How to assemble back a disassembled Linux kernel?
I have a Linux kernel file and I need to tweak the contents of its corresponding initramfs. I did it in the past for standard distros where kernel and initramfs were separate. However, this specific ...
- 141
3
votes
1
answer
58
views
GNU strings with --encoding=S
I have two binaries. Both contain the string "precondition failed" (without the quotes).
The corresponding byte sequence 70 72 65 63 6C 65 64 00 is the same for both binaries. However, the ...
- 1,550
2
votes
2
answers
82
views
Decoding a list of integer values in unknown format
I'm attempting to reverse engineer a binary file format which is used to encode a list of integer values. I can't work out how this format works, as the number of bytes used to encode each value ...
- 73
2
votes
0
answers
65
views
Buffer overflow gets() weird parsing
I'm attempting to do a buffer overflow with gets(). I've figured out how to write over the return address and I'm able to do so, however, I cannot write in the address I need because the 0x7F at the ...
- 21
3
votes
0
answers
56
views
How can I quickly tell which ARM Thumb version a particular piece of code is using?
I'm working with an ARM processor: an STM32F407VGT6 board, which IIUC powers a 32-bit Arm® Cortex®-M4. I need to inspect the binary weight of some instruction, so I used objdump like this:
arm-none-...
3
votes
1
answer
678
views
U-boot base address on Ghidra
I'm trying to do some REing on a vendored U-Boot bootloader image.
For context, the U-Boot image was extracted from the full firmware image with:
dd if=<firmware>.img of=uboot_sdcard.bin bs=1024 ...
- 193
2
votes
0
answers
38
views
Find out what is this binary database entry and what format it is
the following varbinary "BUFFER" of a database entry is for an article.
FIELD_0 is in plain text and the item name is "1", which I created with the item management software.
[...
- 21
2
votes
0
answers
49
views
How to obtain import name from disassembled assembly
I'm trying to create my own tools for reverse engineering PE. I have some assembly codes that I fetched from a clone of objdump for a program. Sometimes I see call instructions such as :
callq *...
- 21
2
votes
1
answer
578
views
Trying to reverse a bin file
I'm trying to reverser a bin file with Ghidra, without success for the moment, I can't find any functions in the decompiled file.
he bin file is for an ARM 32bits, I'm pretty sure this is an stm32, so ...
- 131
0
votes
1
answer
313
views
Which tools are available to see embedded image and sound data
I'm reverse engineering a program from a memory dump using Ghidra. I know there are sections which contain images and sampled sound data in a raw format.
I'm looking for a tool which will let me view ...
- 183
2
votes
0
answers
46
views
How to get the APIs present in a particular block in a CFG using Angr?
I'm doing binary analysis based on Control Flow Graph (CFG). As I suppose to get the APIs from every block in the CFG. I'm finding it very difficult to do so using Angr as I don't have enough grip on ...
- 39
1
vote
1
answer
498
views
Reverse Engineering Go obfuscated binaries
I have been trying to understand the working of this go malware by reversing it, which can be found here , so basically this stuff takes a shellcode as an input, and converts it to an exe or dll file, ...
- 11
1
vote
1
answer
51
views
How to know each register value instruction by instruction in a binary using radare2?
As I am using the radare2 for reverse engineering, I find it very difficult to get all the register values instruction by instruction with the help of the Radare2 tool. Could someone please help me to ...
- 39
2
votes
0
answers
43
views
LZ4N file format - file decoding
I'm trying to decode a file that is part of device firmware. Unfortunately it comes RIFF<...>WAV format wrapped / packed with strange LZ4-like format.
Non of linux available lz4 tools do ...
- 21
2
votes
0
answers
559
views
Firmware Binary Reverse with Ghidra returns only few codelines decompiled with truncated code
I have tried to decompile the firmware binary of a microcontroller that should be an STM32 (but I'm not sure about this).
After the analysis I get only few codelines with a lot of similar messages:
...
- 121
0
votes
1
answer
135
views
Reversing encrypted file with unknown extension
Hello to everyone in RE section!
I have a binary file with questionable extension(meaning idk if its exe/dll).
Multiple variations of this file can be acquired throught connection to remote CDN via ...
1
vote
1
answer
80
views
Under what circumstances relative to instr rip+offsets to .rdata data may not match?
I have a 100Mb binary file, in which I need to find and patch specific bytes in a function. When disassembled in IDA, this function is the only thing that ever references on unique ASCII string via ...
- 53
3
votes
0
answers
382
views
Reverse-engineering the Sony Camset (Camera Settings) file format
Context
Newer Sony cameras have functionality that allows them to:
save the current camera settings (shooting mode, auto-focus mode, etc.) to a file
load the camera settings from a file into the ...
- 161
3
votes
0
answers
709
views
Find constant variables with float values using Ghidra
I dumped an il2cpp.so with il2cppDumper and in the dump.cs I found that the variables I wanted to change its values are somewhat constant float. this is the snippet:
// Namespace:
public class ...
- 309
2
votes
0
answers
81
views
jump to invalid address when emulating
I am currently working on a deobfuscation tool for a Windows Driver (which is obfuscated). I am using Capstone to disassemble and Unicorn to emulate. I have run into a weird issue where the indirect ...
- 41
1
vote
0
answers
85
views
How exactly Hex editor is used?
I'm new to reverse engineering. So I decided to start with some game files in my computer. The main goal was to understand how hex editor used to identify files and extract needed data.
In my case I ...
- 11
2
votes
1
answer
96
views
Need help decoding bytes to number
I've got a really really old file format from an accounting software, late '70s, DOS, QBasic or QuickBasic. Source code is lost, only .exe file remaining, file needs emulator.
The file formate seems ...
- 141
0
votes
1
answer
99
views
ida jumping to address I can't see in driver
When I open this driver in IDA i can't seem to see the instructions that this jmp at 0x1400DC46D jumps to.
I've tried to undefine bytes and re-analyze the function but it then ends up will garbage. ...
- 41
2
votes
0
answers
6k
views
Extracting ZTE F670L router's config.bin file
I want to enable telnet in my router (ZTE F670L V9.0.11P1N20D), So, I backup my router and i have a file config.bin, Size 23.5KB. I fired up kali and when i issue this command:
$ file config.bin
...
- 21
1
vote
1
answer
495
views
Ida cannot open. a files of esp32 (Xtensa)
I tried to open this file with IDA Pro
https://github.com/espressif/esp32-wifi-lib/blob/master/esp32/libpp.a
Ida detect that is ELF for Xtensa (relocatable)
But when I tired to open it I got
Undefined ...
- 281
1
vote
2
answers
490
views
Changing the jne to je instruction causes program to generate error
I'm trying to change the instruction from jne to je
I've change an instruction
75 0c jne [some_location]
75 0c is a 2 jump instruction.
So, I've a chaged it to from 75 0c to 74 0c which is ...
- 63
0
votes
1
answer
105
views
ROP: System function not printing results to stdout
in oder to solve a CTF-Challenge I have to construct a small ROP-chain. The scope of the ROP chain is to print the content of the `flag` file. I already constructed the ROP-chain, but it seems that ...
