Questions tagged [binary-analysis]
The process of gathering information about a binary file, either with static or dynamic methods.
0
votes
1answer
106 views
Basic Blocks and Data Flow Analysis
I am looking to do some Data Flow Analysis via code. I have already the code that parses a binary and disassembles it (x86/x64) and creates Basic Blocks.
Now what I would like to do is, for any Basic ...
0
votes
0answers
28 views
How could a function stored into a static variable be used without an explict call at any point?
Disclaimer: I'm new to RE and I'm trying to hone my skills.
I'm trying to reverse some C code and I noticed the following instructions (x86) that store a function into a static variable in the .bss ...
2
votes
1answer
26 views
obtaining string value from Unknown elf-x86-64 binary with gdb
I'm trying to find a string value stored in memory by a binary (possibly written in C) that won't show up when I perform "strings a.out". I have tried examining particular memory addresses of interest ...
4
votes
1answer
188 views
Reverse Engineering bios of ATM Machine
I bought an Hyosung NH1500 off Offer-up and it boots up and initializes some peripherals and then spits out and error of "COM download is failed". I've searched Google and 0 results came up, I've been ...
1
vote
1answer
70 views
How to convert Unexplored data in IDA Pro to code？
I am analyzing a malware, it has a lot of confusing methods, I wrote an idc script to remove confusion, use the MakeCode() function to convert some Unexplored data into code, but there are still some ...
1
vote
2answers
42 views
Getting a high level overview of comparative size differences of binary files?
I have two binary files, one of them is pulled from Protostar's (stack0 example). The other one I compiled (from source) with the latest version of GCC. The size difference is massive. My version is ...
-2
votes
1answer
160 views
Extract data from firmware (.bin) file which is compressed or encrypted
I have a firmware image of LCD TV that I want to research. Basically I want to customize RGB color settings (from source code), Logo of TV ... Is it possible? I binwalk to scan the file.
binwalk ...
1
vote
1answer
78 views
Reverse Engineering And Rendering Old Image Format .CEL
I want to reverse engineer titltext.cel .CEL image format and render this in SDL2.
I happen to know a little bit about the CEL file that I am working with. I know it is supposed to be a sprite-sheet ...
6
votes
1answer
168 views
Reverse engineering Windows Defender's signature for Metasploit Framework's metsrv.dll
As a pentester for a consulting agency, it is part of our job to "evade" antivirus after gaining code execution on information systems. It is indeed necessary to prove exploitation of vulnerabilities, ...
1
vote
1answer
50 views
Reversing characters from argument of the program
Below code is from the IDA.
This is the code before the parsing function:
movzx eax, byte ptr [rbp+nineth_char+3]
movsx eax, al
mov edi, eax
call sub_898
And this is the code of the ...
2
votes
2answers
53 views
Wrong RVA values inside IMAGE_IMPORT_DESCRIPTOR
I load the entire PE into an std::vector<Byte> fileContent using std::fstream.
Then I obtain the executable's dos header:
IMAGE_DOS_HEADER* imageDosHeader = (IMAGE_DOS_HEADER*)fileContent.data(...
0
votes
3answers
91 views
What to do with .dd files? [closed]
Okay so I am doing picoCTF and I am very new to ctf. Now in one of the questions I am given a .dd file and the hint says Some files have been deleted from the disk image, but are they really gone?
I ...
0
votes
0answers
53 views
Bypass App Protection
So I'm trying to unpack some application I have but it gives me really hard time.
I'm starting from the system entry point and give it a shot, the application then jump into TLS callback of the loaded ...
2
votes
1answer
61 views
Remove Binary from IDA Database
I saw the File -> Load File -> Additional Binary File option and tried it out. Now I want my original IDA database back (with just one binary), but can't afford to lose the comments I have saved ...
1
vote
0answers
43 views
Is there any way to capture the state of an application so as to restore execution of it later?
There are certain older, non-DirectX-based games that I can hack inside of a VM, which is amazing because I can save snapshots of states to then restore if, say, the game crashes after I attempt ...
1
vote
0answers
119 views
Naruto Uzumaki Chronicles 2 .RAW Files [PS2]
I'm have been trying to mod these game for years, but I still stuck with the raw files from RACJIN games, [same case as Fullmetal Alchemist & Bleach]. The files appear to be compressed, and a ...
4
votes
0answers
81 views
How do I perform concolic execution with Angr and collect constraints on input?
I have a program that takes a string (with some structure) as input. My aim is to collect information on what values each character in input is compared to as it gets parsed using concolic execution. ...
4
votes
1answer
83 views
Heap Chunk Structure Does Not Contain Previous Section Info
I'm reading Shellcoder's Handbook to learn more about exploitation and overflows. I reached the chapter on Heap Overflows. The book mentions that a heap is split into chunks where each chunk contains ...
1
vote
1answer
82 views
What is the difference between stripped binary and obfuscated binary
I want to know the difference between stripped binary and obfuscated binary.
4
votes
2answers
51 views
Are some special chars(<>) in function names not supported by windbg/cdb?
I have a function in a binary like this class<class1::class2>::function. I can't directly use commands like bp, u, x on the function. The only option I have right now is x class* and then look ...
0
votes
1answer
81 views
Algorithm to find secret cipher S-box in bin file [closed]
Is there any algorithm that searches through binary file and detects existence of secret S-box built from look-up table (4 bit or 8 bit)? Consider the sbox is unavailable for public
The attached bin ...
0
votes
0answers
26 views
Using yara to obtain information from binary (not matching)
I would like to use yara to extract information from a binary.
I went through the doc but did not understand how to always get a certain piece of information. For example:
import "dotnet"
rule ...
0
votes
0answers
65 views
IDA doesn't see code
I'm trying to analyze some binary but IDA doesn't see code inside .reloc section. I loaded it manually, changed segment class from DATA to CODE and marked as executable. In 010 Editor these bytes are ...
0
votes
1answer
95 views
When to create a keygen versus when to bypass the security jumps
I am a newbie reverse engineer.
I was wondering: assuming I want to crack a program (With the permission of the author of course) and I have detected the Assembly where the program begins to check the ...
2
votes
1answer
172 views
Binwalk does not show anything when process binary
I tried use Binwalk to extract content of binary firmware image dumped from flash, but Binwalk does not show anything.
I tried commands
binwalk -Me file.bin
binwalk --dd='.*' file.bin
strings ...
7
votes
0answers
124 views
Analyzing a Revit project file
I've been messing around with Revit and trying to understand the internal data structures for its file format. I'm not particularly experienced with this type of work and the processes around reverse ...
2
votes
1answer
80 views
Detect interesting testcases
Suppose I have a ton of test cases and my target is closed-source. Well, I need to know which test cases discover new path in the execution of my target and which are duplicated. I know I have to use ...
1
vote
0answers
91 views
What is the format of this binary file?
I have a binary file that I found on a 3D printer that is used to program a dsPIC30F5011 microcontroller. It is responsible for some basic data encryption. The only problem is, I am not sure how this ...
0
votes
1answer
103 views
Is this firmware using a substitution cipher?
I'm trying to extract data from a firmware file.
I used binwalk on the firmware, which found a single chunk of Zlib compressed data. I uncompressed this data, and used strings on the result, which ...
3
votes
2answers
48 views
Finding a particular call to an offset within a vtable using pattern matching
Let's say I have a very simple pattern I'm looking for. E.g. the following regex,
mov.*(eax|edx|ecx|esi|edi), \[(eax|edx|ecx|esi|edi)\+30h\]
Now, I'm also looking for references to this in which the ...
1
vote
1answer
34 views
Why would an ELF SHT_REL section contain relocations outside the section its sh_info refers to?
I have a .so from an Android JNI/NDK application. Here are two of its sections:
[Nr] Name Type Addr Off Size ES Flg Lk Inf Al
[10] .rel.plt REL ...
1
vote
0answers
46 views
How to make sense of this one pin serial communication
I am trying to reverse engineer a serial communication between to microcontrollers (1 device & 1 microcontroller on a board). One MCU validates the other MCU and I want to crack the validation and ...
1
vote
0answers
121 views
Unknown Game Client Data
As asking a friend and no amount of Googling yielded an answer, I figured I'd make an account and give this place a go.
I'm working on reverse engineering the server for a relatively old game with no ...
4
votes
1answer
116 views
Is this Bignum multiplication of 2048 RSA number a Montgomery multiplication?
The below code snippets are some kind of bignum multiplications involving 2048bit numbers, possibly in the context of RSA decryption.
Does any one recognize this pattern?
Is it maybe some kind of ...
3
votes
1answer
100 views
What are the popular machine learning unsupervised approaches to learning binary data representations?
This is somewhat open-ended question, so bear with me please.
Be it a binary payload that you pull from network packet, firmware blob you pull of some EPROM or data intercepted straight from physical ...
3
votes
1answer
94 views
What are the steps to reverse engineering a Shockwave .DCR file?
I have been fascinated by reverse engineering after making several emulators and finding the pret community. I love the idea behind decompiling old games and recreating source code that recompiles ...
3
votes
2answers
183 views
Is pointer decryption possible?
I’m pretty new to reverse engineering, so bear with me...
I’m trying to get a few struct definitions (or whatever they’re called) from this one binary. After some time fiddling around with it, I’ve ...
0
votes
0answers
40 views
Identify variable length header encoding
I have a file generated by Microsoft OneNote Online service. It contains a lot of attached binary files and I need to extract all of them.
All attachments are stored inside the file in the following ...
-3
votes
1answer
204 views
Identification of AES portion code in binary
I want to locate AES code portion in binary after reverse engineering. I have tried to locate manually and using plugin findcrypt2 but I was not successful. Kindly show me a direction so that I can ...
1
vote
1answer
236 views
r2pipe won't prompt for user input like the binary does in r2 debugger mode
Have a functioning r2pipe script, but there's a need for hitting crtl-c to continue near the breakpoint(not a major issue,) however the script does not pause for input when the crackme asks for user ...
0
votes
1answer
131 views
how to understand branch arm instruction
I have this instruction F6F700B8 I know that it b #-0xA000 but how I can understand from F6F700B8 that is b #-0xA000 ? .
When I tried to translate it on http://armconverter.com/hextoarm/ I get B.W #...
1
vote
2answers
60 views
How is the IV generated from a timestamp based on this function?
Background: I am currently looking to make some diagnostic software interoperable with other software, but all communication that occurs in this software is encrypted with AES-128-CBC. A sample ...
1
vote
1answer
269 views
bypassing anti-VM inside protected samples
This is a good starting point.
As you know:
Sandboxes and virtual environments (hypervisors) are full of artifacts that betray their analysis environment. Malware can protect itself against these by ...
0
votes
1answer
127 views
IDA Pro Address doesn't correlate to Immunity Debugger address
I'm trying to use immunity debugger to step through a confusing binary.
When I open it in IDA Pro, I see certain addresses next to the instructions:
.text:01001392 inc eax
When I ...
7
votes
2answers
496 views
Radare2 Find command line arguments and location in stack
This might have a simple solution but I can't find it anywhere.
$> ./be1 11 AAAAA
With gdb, finding argv[] and argc is simple:
(gdb) print argv[0]@argc
$7 = {0xbffff872 "be1", 0xbffff89a "11", ...
-1
votes
1answer
43 views
Understanding what is represented by function pointers to a block of hex
I'm working on a disassembly project for my class where I'm trying to bypass a license check, but when I throw the executable into Binary Ninja this is what I see:
And when I look at those pointers, ...
0
votes
1answer
41 views
Ldr arm thumb2 must be multiple of 4?
I saw here http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0489c/CIHDGFEG.html that on arm thumb2 ldr must be multiple of 4.
I run on arm thumb 2 and want run this instruction ldr r0, ...
5
votes
0answers
154 views
How to find if a given library function is used in a binary?
Assuming that library X is statically linked, is there a way to know with an acceptable grade of confidence if a function from it was used in the binary?
I am currently using this approach:
Convert ...
0
votes
1answer
84 views
Arm function save registers r0 and r1
I see arm 32 bits assembly code.
Usually each function do push { r4-r9,lr} ( save 6 registers on stack ). And in the end of function pop them .
I see function that save push {r0,r1,r4-r9,lr} but ...
0
votes
2answers
175 views
How to obtain memory address of string literal?
I am trying to find where a specific string literal is used in a compiled program. I have already found the location of this string literal within the executable; I want to somehow deduce what the ...
