Questions tagged [binary-analysis]

The process of gathering information about a binary file, either with static or dynamic methods.

Filter by
Sorted by
Tagged with
3 votes
1 answer
93 views

💻 This code does not crash on ARM (qemu). Why?

I found a couple of interesting integer underflows leading to memcpy() wild copies in a TLV parser process of some random IoT firmware. It is 32-bit ARMv7. I'm able to emulate the userspace process ...
4 votes
1 answer
136 views

Mickey Mouse toy bin file analysis

I am trying to reverse engineer a Mickey Mouse toy just for fun but I am stuck. The toy has several buttons that play various phrases and songs. My aim was to see if I can read those songs from the ...
3 votes
0 answers
81 views

How to assemble back a disassembled Linux kernel?

I have a Linux kernel file and I need to tweak the contents of its corresponding initramfs. I did it in the past for standard distros where kernel and initramfs were separate. However, this specific ...
  • 131
2 votes
1 answer
44 views

GNU strings with --encoding=S

I have two binaries. Both contain the string "precondition failed" (without the quotes). The corresponding byte sequence 70 72 65 63 6C 65 64 00 is the same for both binaries. However, the ...
  • 1,508
1 vote
2 answers
58 views

Decoding a list of integer values in unknown format

I'm attempting to reverse engineer a binary file format which is used to encode a list of integer values. I can't work out how this format works, as the number of bytes used to encode each value ...
  • 63
1 vote
0 answers
50 views

Buffer overflow gets() weird parsing

I'm attempting to do a buffer overflow with gets(). I've figured out how to write over the return address and I'm able to do so, however, I cannot write in the address I need because the 0x7F at the ...
3 votes
0 answers
32 views

How can I quickly tell which ARM Thumb version a particular piece of code is using?

I'm working with an ARM processor: an STM32F407VGT6 board, which IIUC powers a 32-bit Arm® Cortex®-M4. I need to inspect the binary weight of some instruction, so I used objdump like this: arm-none-...
2 votes
1 answer
247 views

U-boot base address on Ghidra

I'm trying to do some REing on a vendored U-Boot bootloader image. For context, the U-Boot image was extracted from the full firmware image with: dd if=<firmware>.img of=uboot_sdcard.bin bs=1024 ...
1 vote
0 answers
36 views

Find out what is this binary database entry and what format it is

the following varbinary "BUFFER" of a database entry is for an article. FIELD_0 is in plain text and the item name is "1", which I created with the item management software. [...
1 vote
0 answers
40 views

How to obtain import name from disassembled assembly

I'm trying to create my own tools for reverse engineering PE. I have some assembly codes that I fetched from a clone of objdump for a program. Sometimes I see call instructions such as : callq *...
  • 11
2 votes
1 answer
249 views

Trying to reverse a bin file

I'm trying to reverser a bin file with Ghidra, without success for the moment, I can't find any functions in the decompiled file. he bin file is for an ARM 32bits, I'm pretty sure this is an stm32, so ...
  • 131
2 votes
0 answers
366 views

GDB "Cannot access memory at address ...." Breakpoint error

I have not yet found the solution on internet so i ask it here. Never had this problem before it was always doing fine, so i don't know what changed. I'm using gdb peda but the problem stays the same ...
0 votes
1 answer
134 views

Which tools are available to see embedded image and sound data

I'm reverse engineering a program from a memory dump using Ghidra. I know there are sections which contain images and sampled sound data in a raw format. I'm looking for a tool which will let me view ...
1 vote
0 answers
42 views

How to get the APIs present in a particular block in a CFG using Angr?

I'm doing binary analysis based on Control Flow Graph (CFG). As I suppose to get the APIs from every block in the CFG. I'm finding it very difficult to do so using Angr as I don't have enough grip on ...
1 vote
1 answer
42 views

How to know each register value instruction by instruction in a binary using radare2?

As I am using the radare2 for reverse engineering, I find it very difficult to get all the register values instruction by instruction with the help of the Radare2 tool. Could someone please help me to ...
1 vote
0 answers
28 views

LZ4N file format - file decoding

I'm trying to decode a file that is part of device firmware. Unfortunately it comes RIFF<...>WAV format wrapped / packed with strange LZ4-like format. Non of linux available lz4 tools do ...
1 vote
0 answers
224 views

Firmware Binary Reverse with Ghidra returns only few codelines decompiled with truncated code

I have tried to decompile the firmware binary of a microcontroller that should be an STM32 (but I'm not sure about this). After the analysis I get only few codelines with a lot of similar messages: ...
  • 111
0 votes
1 answer
89 views

Reversing encrypted file with unknown extension

Hello to everyone in RE section! I have a binary file with questionable extension(meaning idk if its exe/dll). Multiple variations of this file can be acquired throught connection to remote CDN via ...
1 vote
1 answer
40 views

Under what circumstances relative to instr rip+offsets to .rdata data may not match?

I have a 100Mb binary file, in which I need to find and patch specific bytes in a function. When disassembled in IDA, this function is the only thing that ever references on unique ASCII string via ...
  • 43
1 vote
0 answers
191 views

Reverse-engineering the Sony Camset (Camera Settings) file format

Context Newer Sony cameras have functionality that allows them to: save the current camera settings (shooting mode, auto-focus mode, etc.) to a file load the camera settings from a file into the ...
2 votes
0 answers
334 views

Find constant variables with float values using Ghidra

I dumped an il2cpp.so with il2cppDumper and in the dump.cs I found that the variables I wanted to change its values are somewhat constant float. this is the snippet: // Namespace: public class ...
  • 219
1 vote
0 answers
67 views

jump to invalid address when emulating

I am currently working on a deobfuscation tool for a Windows Driver (which is obfuscated). I am using Capstone to disassemble and Unicorn to emulate. I have run into a weird issue where the indirect ...
  • 21
0 votes
0 answers
335 views

Binwalk doesn't give results

I'm trying to reverse engineer a .bin file but binwalk doesn't give much information other than it says that there is a bitmap contained. The .bin file is 32 MB. Ghidra also doesn't input anything ...
0 votes
0 answers
72 views

How exactly Hex editor is used?

I'm new to reverse engineering. So I decided to start with some game files in my computer. The main goal was to understand how hex editor used to identify files and extract needed data. In my case I ...
2 votes
1 answer
77 views

Need help decoding bytes to number

I've got a really really old file format from an accounting software, late '70s, DOS, QBasic or QuickBasic. Source code is lost, only .exe file remaining, file needs emulator. The file formate seems ...
  • 141
0 votes
1 answer
51 views

ida jumping to address I can't see in driver

When I open this driver in IDA i can't seem to see the instructions that this jmp at 0x1400DC46D jumps to. I've tried to undefine bytes and re-analyze the function but it then ends up will garbage. ...
  • 21
1 vote
0 answers
3k views

Extracting ZTE F670L router's config.bin file

I want to enable telnet in my router (ZTE F670L V9.0.11P1N20D), So, I backup my router and i have a file config.bin, Size 23.5KB. I fired up kali and when i issue this command: $ file config.bin ...
1 vote
1 answer
320 views

Ida cannot open. a files of esp32 (Xtensa)

I tried to open this file with IDA Pro https://github.com/espressif/esp32-wifi-lib/blob/master/esp32/libpp.a Ida detect that is ELF for Xtensa (relocatable) But when I tired to open it I got Undefined ...
  • 151
1 vote
2 answers
290 views

Changing the jne to je instruction causes program to generate error

I'm trying to change the instruction from jne to je I've change an instruction 75 0c jne [some_location] 75 0c is a 2 jump instruction. So, I've a chaged it to from 75 0c to 74 0c which is ...
0 votes
1 answer
48 views

ROP: System function not printing results to stdout

in oder to solve a CTF-Challenge I have to construct a small ROP-chain. The scope of the ROP chain is to print the content of the `flag` file. I already constructed the ROP-chain, but it seems that ...
2 votes
1 answer
60 views

Radare2 only printing out the last byte at RSP when using pxq @ rsp

According to documentation, px[?][owq] [len]    hexdump of N bytes (o=octal, w=32bit, q=64bit) and pr[?][glx] [len]    print N raw bytes (in lines or hexblocks, 'g'unzip) These two ...
1 vote
0 answers
62 views

nrf52-based localization tag flash dump and modification

Lately I've bought a localisation tag (Apple AirTag alike). When I click a button on my cell phone, the device plays a chiptune-like ringtone. The ringtone is configurable using the app and stored on ...
  • 11
0 votes
0 answers
220 views

ida shows instructions as hex data

I am new to reverse engineering. I did a couple of projects. now I was doing another project and faced kind of a problem. at the start of the program, there is a label that points to an address of ...
1 vote
0 answers
89 views

Extracting Binary Stream inside an mp3

In the song Chisel by Pruient there seems to be what sounds like a binary octet stream starting at 4:43. The section of noise has distinct sections punctuated with momentary silence which leads me to ...
0 votes
1 answer
2k views

How to exploit __isoc99_scanf with a segmentation fault

I'm an absolute newbie when it comes to all this side of reverse engineering. Each time I try and understand it, I get lost almost immediately. I am trying a lab. I open it up in Binary Ninja. I get ...
  • 221
2 votes
1 answer
687 views

How to call a func in an executable binary?

I have a binary with a func that I can disassemble. What are simple ways for me to call it with arbitrary args and observe its return val and behavior? Ideally, I'd like to do this: Within gdb (or ...
0 votes
0 answers
217 views

Reverse engineering STM32F303 firmware udpate

I have an .exe file, which connects via USB to a STM32F303 peripheral with unknown firmware. The .exe is able to update the STM32 firmware via the USB. The firmware update is also provided, and its ...
  • 31
1 vote
1 answer
302 views

Binary diff + patching across versions

What are the current options for binary patching which works across different versions of the binary? E.g. we created a binary patch for a specific version of a binary and want to apply that patch to ...
3 votes
1 answer
192 views

What is data only exploitation?

I was wondering, and after trying to read for the past several months I got totally lost and don't understand this concept. Could someone please explain in simple words the concept of data only ...
  • 31
2 votes
1 answer
104 views

When would a program normally transfer data between memory and coprocessor?

In the analysis of an ARM binary, when would one normally encounter transfer operations between memory and a coprocessor? These are encoded as the LDC and STC operators. Would it be common for ...
  • 123
0 votes
0 answers
129 views

How do I view registers at a specific point of a binary's execution?

I have a binary that I'm attempting to reverse engineer to find a flag. From using ghidra I have found that the flag is stored in the program at a point called "check" and then run through ...
0 votes
0 answers
346 views

Extract smartwatch firmware bin file

I'm trying to extract files from a bin file that's the firmware of a smartwatch. I tried using binwalk -Mre firmware.bin but got no files, this is the result: How should I extract/modify this bin ...
1 vote
2 answers
864 views

Can't figure out a crash in IDA "The memory could not be read -> 00000710 (exc.code c0000005, tid 20612)"

I'm trying to debug out a game. Basically, the Steam version works perfectly but the GOG version (which is 8kb smaller) has an annoying problem where for some people (which happen to be me) the game ...
2 votes
1 answer
229 views

Proprietary 3D Format Reverse Engineering: What Could These Numbers And Matrices Represent?

I'm trying to reverse engineer a model format from an older Russian game (Pathologic) with limited success. It is a proprietary model format not recognized by any converters/editing tools (believe me, ...
  • 21
0 votes
1 answer
67 views

string pointer to byte conversion condition

I am trying to understand the following snippet. I understand that the first check would check if it is even if it would be an int, but I don't understand it in this context. Could someone explain to ...
  • 3
1 vote
0 answers
101 views

Unknown binary format (.scp) - No Header

I hope everyone is doing well. I've recently been trying to decode the structure of some files that contain a lot Unicode-8 IIRC characters, with a mix of binary. When I put it into IDA, I can't seem ...
  • 11
1 vote
0 answers
51 views

How to find references for a string (where it is being called) in Go binary

I have a Go binary and I have this string: When I go to its location, with IDA Pro, and tries to find all the references (using x) I am getting a message that there are no references: It might be ...
  • 573
2 votes
1 answer
244 views

Reverse engineering Roland TR-8S kit file format .t8k

I'm trying to figure out the file format that the Roland TR-8S drum machine uses for importing/exporting drum kits. My goal is to replace the sample (PCM) data within a kit. It's a proprietary binary ...
0 votes
0 answers
566 views

Extracting Userdata from Userdata.bin file backup of oneplus 7pro mobile

I have userdata backup file (Userdata.bin) of oneplus 7pro. I want to extract photos and videos from this. when i used the command "binwalk userdata.bin" it shows DECIMAL HEXADECIMAL ...
  • 1
2 votes
0 answers
517 views

Repacking vmlinux into zImage/bzimage

While RE an embedded device I ran into a problem - I need to patch a check in the kernel which has no sources available. Unpacking the kernel and binary-patching went smoothly. However I cannot get ...
  • 163

1
2 3 4 5
11