Questions tagged [binary-analysis]
The process of gathering information about a binary file, either with static or dynamic methods.
1
vote
1answer
25 views
When can trapping be used?
This is the beginning of one of the functions inside NTDLL of Windows XP:
MOV EDI,EDI
PUSH EBP
MOV EBP,ESP
...
My book on reverse engineering says this about the first line:
It is essentially ...
1
vote
0answers
42 views
Argument types not identified when parsing declarations
I'm trying to add a dynamic import segment in the IDA database which contains functions names, and I'm applying type information to it, so that I can obtain argument locations by using ...
1
vote
2answers
48 views
Calculation with not defined variables?
I am new to reverse engineering and try to solve a crackme with radare2.
My problem is understanding of the following lines:
| 0x000007a9 c745b8000000. mov dword [var_48h], 0
| ...
2
votes
1answer
59 views
Extract a secret from an Android apk or .so file
Context
As an exercise I am researching all methods of hiding a secret in an android mobile app binary... Yes I know that with more or less effort they can always be extracted with static analyses, ...
0
votes
0answers
19 views
Will an iOS app (IPA) that requires a login work if I repack it and install it on the device?
I downloaded iOS WhatsApp from App Store, decrypted the binary, repacked it, and installed it back onto the device (deleting the app before installing). When I opened it, it only showed me a blank ...
0
votes
1answer
32 views
How to print the value of register with Radare 2
I am trying to solve this ELF - Ptrace challenge. I use Radare 2. This is the commands I execute to print the assembly code.
radare2 ch3.bin
[0x080482f0]> aaa
[[anal.jmptbl] Missing cjmp bb in ...
2
votes
1answer
64 views
Radare2 does not display the entire assembler code
I am trying to solve this ELF - Ptrace crack me. Here are the commands I use :
I start radare2 with the crack me as argument.
radare2 ch3.bin
I decide to go to the main and print the assembly code ...
0
votes
1answer
58 views
Combine various sub routines into one sub routine (IDA Pro)
Currently I am analyzing a .so file and there is a function which is supposed to be large (high number of nodes and edges). However, IDA Pro identified it as a small function, with various parts of ...
1
vote
2answers
111 views
Emotet invoice, what is the embedded file inside the word document
This pastebin hosts current URLs hosting the fake invoice of Emotet malware, which is the dropper part of the malware.
The document is a Office Open XML, and there are two large non textual segments ...
-2
votes
2answers
203 views
XOR encryption - How to find the key?
I'm trying to solve a crackme which basically uses a XOR encryption scheme in which the password is used as the key to an encrypted buffer which is subsequently executed. The following is the ...
1
vote
0answers
37 views
How can a segfault happen during the libc exit call on Linux?
I'm relatively new to reverse engineering, and I've decided to practise using the challenges from pwnable.tw. Currently, I am working on the "Silver Bullet" challenge.
While testing, I have noticed ...
2
votes
1answer
74 views
ROP chain: Buffer Overflow Return Pointer
I am trying to get a ROP exploit to work on Ubuntu 18.04 LTS 64bit.
I have a 64 bit binary (Nx enabled, ASLR disabled) with vuln function as follows:
public vuln
vuln proc near
var_100= byte ptr -...
1
vote
1answer
54 views
IDA - large jump table, missing cases in analysis
I have come across the following jump table with a large amount of cases (160+). There seems to be cases missing from IDAs analysis though. For example it skips from cases 22 -> 38 -> 91, and I can ...
0
votes
1answer
57 views
rip adress not visible with dr command
I just finished this challenge. This is the content of main function :
[0x08048a86]> pdf
/ (fcn) main 417
| main (int argc, char **argv, char **envp);
| ; var int local_16h @ ebp-0x16
|...
2
votes
1answer
55 views
Debug point not hit with radare2
I am doing this reverse engenering challenge. I executed theses commands to analyse the main function :
radare2.exe ch15.exe
aaa
s main
pdf
This is the output of the pdf command :
[0x004017b8]> ...
1
vote
2answers
122 views
Lots of mov instructions into ebp+offset - What is happening?
While learning RE I have come across this large segment of instructions that contains a majority of mov [ebp+offset], value instructions. I believe that ebp + offset are local variables? I think? ...
1
vote
1answer
146 views
How to reverse engineer a Black Box?
I am trying to reverse engineer / research a black box system, this is, a system for which there is no public information at all. Let's say the system is a modern handheld console.
I have already ...
0
votes
1answer
33 views
How to determine number and/or boundaries of linked object files in a PE generated by Visual Studio 6?
In this analysis of a Portable Executable linked using Microsoft Linker (6.0), down in the Imported Objects section, the website makes some very specific claims:
3 .OBJ Files (COFF) linked with LINK....
1
vote
1answer
52 views
What are those instructions doing?
I'm having a hard time figuring out whatever the hell this is doing.
mov rax, [rbp+var_720]
mov [rbp+var_458], rax
mov rax, [rbp+var_458]
mov [rbp+command_], rax
mov rax, [rbp+...
0
votes
1answer
76 views
How do I interpret the mangled functions name?
I am going to start by saying that this is my fourth attempt at reverse engineering a crackme and I'm starting to understand how assembly works, which is cool. I am sorry if this question is wrong or ...
0
votes
1answer
110 views
pwntools shellcode narnia2
I'm trying to solve the narnia2 challenge on overthewire.
I read a guide for help and managed to overwrite the stack with A's using some python
$(python -c "print 'A'*132 + '\xef\xbe\xad\xde'")
...
1
vote
1answer
135 views
Impossible to execute a program with radare2 : TO DO continue
I am trying to crack a crackme. I already catch the flag because I seen the string variable which represants flag. I would like to catch the flag on an other way, I want to set a breakpoint when there ...
0
votes
1answer
52 views
Why can't I decode this UART signal?
I have a modem that I'm trying to get into. It's composed of two SoCs, both with UART headers. I was already successful trying to connect to the first SoC's UART, with my USB-to-UART CP2102 decoder ...
1
vote
1answer
107 views
Analyze all functions with radare2
I have a big library in which IDA found ~84300 functions but using aa in radare2 I was just able to found ~3000.
I tried setting anal.hasnext to true, anal.from and anal.to to the start and the end ...
0
votes
2answers
184 views
Basic Blocks and Data Flow Analysis
I am looking to do some Data Flow Analysis via code. I have already the code that parses a binary and disassembles it (x86/x64) and creates Basic Blocks.
Now what I would like to do is, for any Basic ...
2
votes
1answer
31 views
obtaining string value from Unknown elf-x86-64 binary with gdb
I'm trying to find a string value stored in memory by a binary (possibly written in C) that won't show up when I perform "strings a.out". I have tried examining particular memory addresses of interest ...
4
votes
1answer
227 views
Reverse Engineering bios of ATM Machine
I bought an Hyosung NH1500 off Offer-up and it boots up and initializes some peripherals and then spits out and error of "COM download is failed". I've searched Google and 0 results came up, I've been ...
1
vote
1answer
207 views
How to convert Unexplored data in IDA Pro to code？
I am analyzing a malware, it has a lot of confusing methods, I wrote an idc script to remove confusion, use the MakeCode() function to convert some Unexplored data into code, but there are still some ...
1
vote
2answers
49 views
Getting a high level overview of comparative size differences of binary files?
I have two binary files, one of them is pulled from Protostar's (stack0 example). The other one I compiled (from source) with the latest version of GCC. The size difference is massive. My version is ...
-2
votes
1answer
328 views
Extract data from firmware (.bin) file which is compressed or encrypted
I have a firmware image of LCD TV that I want to research. Basically I want to customize RGB color settings (from source code), Logo of TV ... Is it possible? I binwalk to scan the file.
binwalk ...
1
vote
1answer
98 views
Reverse Engineering And Rendering Old Image Format .CEL
I want to reverse engineer titltext.cel .CEL image format and render this in SDL2.
I happen to know a little bit about the CEL file that I am working with. I know it is supposed to be a sprite-sheet ...
7
votes
2answers
274 views
Reverse engineering Windows Defender's signature for Metasploit Framework's metsrv.dll
As a pentester for a consulting agency, it is part of our job to "evade" antivirus after gaining code execution on information systems. It is indeed necessary to prove exploitation of vulnerabilities, ...
1
vote
1answer
56 views
Reversing characters from argument of the program
Below code is from the IDA.
This is the code before the parsing function:
movzx eax, byte ptr [rbp+nineth_char+3]
movsx eax, al
mov edi, eax
call sub_898
And this is the code of the ...
2
votes
2answers
118 views
Wrong RVA values inside IMAGE_IMPORT_DESCRIPTOR
I load the entire PE into an std::vector<Byte> fileContent using std::fstream.
Then I obtain the executable's dos header:
IMAGE_DOS_HEADER* imageDosHeader = (IMAGE_DOS_HEADER*)fileContent.data(...
0
votes
3answers
194 views
What to do with .dd files? [closed]
Okay so I am doing picoCTF and I am very new to ctf. Now in one of the questions I am given a .dd file and the hint says Some files have been deleted from the disk image, but are they really gone?
I ...
2
votes
1answer
72 views
Remove Binary from IDA Database
I saw the File -> Load File -> Additional Binary File option and tried it out. Now I want my original IDA database back (with just one binary), but can't afford to lose the comments I have saved ...
1
vote
0answers
45 views
Is there any way to capture the state of an application so as to restore execution of it later?
There are certain older, non-DirectX-based games that I can hack inside of a VM, which is amazing because I can save snapshots of states to then restore if, say, the game crashes after I attempt ...
1
vote
0answers
149 views
Naruto Uzumaki Chronicles 2 .RAW Files [PS2]
I'm have been trying to mod these game for years, but I still stuck with the raw files from RACJIN games, [same case as Fullmetal Alchemist & Bleach]. The files appear to be compressed, and a ...
4
votes
0answers
142 views
How do I perform concolic execution with Angr and collect constraints on input?
I have a program that takes a string (with some structure) as input. My aim is to collect information on what values each character in input is compared to as it gets parsed using concolic execution. ...
4
votes
1answer
144 views
Heap Chunk Structure Does Not Contain Previous Section Info
I'm reading Shellcoder's Handbook to learn more about exploitation and overflows. I reached the chapter on Heap Overflows. The book mentions that a heap is split into chunks where each chunk contains ...
1
vote
1answer
110 views
What is the difference between stripped binary and obfuscated binary
I want to know the difference between stripped binary and obfuscated binary.
4
votes
2answers
55 views
Are some special chars(<>) in function names not supported by windbg/cdb?
I have a function in a binary like this class<class1::class2>::function. I can't directly use commands like bp, u, x on the function. The only option I have right now is x class* and then look ...
0
votes
1answer
87 views
Algorithm to find secret cipher S-box in bin file [closed]
Is there any algorithm that searches through binary file and detects existence of secret S-box built from look-up table (4 bit or 8 bit)? Consider the sbox is unavailable for public
The attached bin ...
0
votes
0answers
41 views
Using yara to obtain information from binary (not matching)
I would like to use yara to extract information from a binary.
I went through the doc but did not understand how to always get a certain piece of information. For example:
import "dotnet"
rule ...
0
votes
1answer
119 views
When to create a keygen versus when to bypass the security jumps
I am a newbie reverse engineer.
I was wondering: assuming I want to crack a program (With the permission of the author of course) and I have detected the Assembly where the program begins to check the ...
2
votes
1answer
308 views
Binwalk does not show anything when process binary
I tried use Binwalk to extract content of binary firmware image dumped from flash, but Binwalk does not show anything.
I tried commands
binwalk -Me file.bin
binwalk --dd='.*' file.bin
strings ...
7
votes
0answers
165 views
Analyzing a Revit project file
I've been messing around with Revit and trying to understand the internal data structures for its file format. I'm not particularly experienced with this type of work and the processes around reverse ...
2
votes
1answer
81 views
Detect interesting testcases
Suppose I have a ton of test cases and my target is closed-source. Well, I need to know which test cases discover new path in the execution of my target and which are duplicated. I know I have to use ...
1
vote
0answers
123 views
What is the format of this binary file?
I have a binary file that I found on a 3D printer that is used to program a dsPIC30F5011 microcontroller. It is responsible for some basic data encryption. The only problem is, I am not sure how this ...
0
votes
1answer
113 views
Is this firmware using a substitution cipher?
I'm trying to extract data from a firmware file.
I used binwalk on the firmware, which found a single chunk of Zlib compressed data. I uncompressed this data, and used strings on the result, which ...
