Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [binary-analysis]

The process of gathering information about a binary file, either with static or dynamic methods.

0
votes
1answer
106 views

Basic Blocks and Data Flow Analysis

I am looking to do some Data Flow Analysis via code. I have already the code that parses a binary and disassembles it (x86/x64) and creates Basic Blocks. Now what I would like to do is, for any Basic ...
0
votes
0answers
28 views

How could a function stored into a static variable be used without an explict call at any point?

Disclaimer: I'm new to RE and I'm trying to hone my skills. I'm trying to reverse some C code and I noticed the following instructions (x86) that store a function into a static variable in the .bss ...
2
votes
1answer
26 views

obtaining string value from Unknown elf-x86-64 binary with gdb

I'm trying to find a string value stored in memory by a binary (possibly written in C) that won't show up when I perform "strings a.out". I have tried examining particular memory addresses of interest ...
4
votes
1answer
188 views

Reverse Engineering bios of ATM Machine

I bought an Hyosung NH1500 off Offer-up and it boots up and initializes some peripherals and then spits out and error of "COM download is failed". I've searched Google and 0 results came up, I've been ...
1
vote
1answer
70 views

How to convert Unexplored data in IDA Pro to code?

I am analyzing a malware, it has a lot of confusing methods, I wrote an idc script to remove confusion, use the MakeCode() function to convert some Unexplored data into code, but there are still some ...
1
vote
2answers
42 views

Getting a high level overview of comparative size differences of binary files?

I have two binary files, one of them is pulled from Protostar's (stack0 example). The other one I compiled (from source) with the latest version of GCC. The size difference is massive. My version is ...
-2
votes
1answer
160 views

Extract data from firmware (.bin) file which is compressed or encrypted

I have a firmware image of LCD TV that I want to research. Basically I want to customize RGB color settings (from source code), Logo of TV ... Is it possible? I binwalk to scan the file. binwalk ...
1
vote
1answer
78 views

Reverse Engineering And Rendering Old Image Format .CEL

I want to reverse engineer titltext.cel .CEL image format and render this in SDL2. I happen to know a little bit about the CEL file that I am working with. I know it is supposed to be a sprite-sheet ...
6
votes
1answer
168 views

Reverse engineering Windows Defender's signature for Metasploit Framework's metsrv.dll

As a pentester for a consulting agency, it is part of our job to "evade" antivirus after gaining code execution on information systems. It is indeed necessary to prove exploitation of vulnerabilities, ...
1
vote
1answer
50 views

Reversing characters from argument of the program

Below code is from the IDA. This is the code before the parsing function: movzx eax, byte ptr [rbp+nineth_char+3] movsx eax, al mov edi, eax call sub_898 And this is the code of the ...
2
votes
2answers
53 views

Wrong RVA values inside IMAGE_IMPORT_DESCRIPTOR

I load the entire PE into an std::vector<Byte> fileContent using std::fstream. Then I obtain the executable's dos header: IMAGE_DOS_HEADER* imageDosHeader = (IMAGE_DOS_HEADER*)fileContent.data(...
0
votes
3answers
91 views

What to do with .dd files? [closed]

Okay so I am doing picoCTF and I am very new to ctf. Now in one of the questions I am given a .dd file and the hint says Some files have been deleted from the disk image, but are they really gone? I ...
0
votes
0answers
53 views

Bypass App Protection

So I'm trying to unpack some application I have but it gives me really hard time. I'm starting from the system entry point and give it a shot, the application then jump into TLS callback of the loaded ...
2
votes
1answer
61 views

Remove Binary from IDA Database

I saw the File -> Load File -> Additional Binary File option and tried it out. Now I want my original IDA database back (with just one binary), but can't afford to lose the comments I have saved ...
1
vote
0answers
43 views

Is there any way to capture the state of an application so as to restore execution of it later?

There are certain older, non-DirectX-based games that I can hack inside of a VM, which is amazing because I can save snapshots of states to then restore if, say, the game crashes after I attempt ...
1
vote
0answers
119 views

Naruto Uzumaki Chronicles 2 .RAW Files [PS2]

I'm have been trying to mod these game for years, but I still stuck with the raw files from RACJIN games, [same case as Fullmetal Alchemist & Bleach]. The files appear to be compressed, and a ...
4
votes
0answers
81 views

How do I perform concolic execution with Angr and collect constraints on input?

I have a program that takes a string (with some structure) as input. My aim is to collect information on what values each character in input is compared to as it gets parsed using concolic execution. ...
4
votes
1answer
83 views

Heap Chunk Structure Does Not Contain Previous Section Info

I'm reading Shellcoder's Handbook to learn more about exploitation and overflows. I reached the chapter on Heap Overflows. The book mentions that a heap is split into chunks where each chunk contains ...
1
vote
1answer
82 views

What is the difference between stripped binary and obfuscated binary

I want to know the difference between stripped binary and obfuscated binary.
4
votes
2answers
51 views

Are some special chars(<>) in function names not supported by windbg/cdb?

I have a function in a binary like this class<class1::class2>::function. I can't directly use commands like bp, u, x on the function. The only option I have right now is x class* and then look ...
0
votes
1answer
81 views

Algorithm to find secret cipher S-box in bin file [closed]

Is there any algorithm that searches through binary file and detects existence of secret S-box built from look-up table (4 bit or 8 bit)? Consider the sbox is unavailable for public The attached bin ...
0
votes
0answers
26 views

Using yara to obtain information from binary (not matching)

I would like to use yara to extract information from a binary. I went through the doc but did not understand how to always get a certain piece of information. For example: import "dotnet" rule ...
0
votes
0answers
65 views

IDA doesn't see code

I'm trying to analyze some binary but IDA doesn't see code inside .reloc section. I loaded it manually, changed segment class from DATA to CODE and marked as executable. In 010 Editor these bytes are ...
0
votes
1answer
95 views

When to create a keygen versus when to bypass the security jumps

I am a newbie reverse engineer. I was wondering: assuming I want to crack a program (With the permission of the author of course) and I have detected the Assembly where the program begins to check the ...
2
votes
1answer
172 views

Binwalk does not show anything when process binary

I tried use Binwalk to extract content of binary firmware image dumped from flash, but Binwalk does not show anything. I tried commands binwalk -Me file.bin binwalk --dd='.*' file.bin strings ...
7
votes
0answers
124 views

Analyzing a Revit project file

I've been messing around with Revit and trying to understand the internal data structures for its file format. I'm not particularly experienced with this type of work and the processes around reverse ...
2
votes
1answer
80 views

Detect interesting testcases

Suppose I have a ton of test cases and my target is closed-source. Well, I need to know which test cases discover new path in the execution of my target and which are duplicated. I know I have to use ...
1
vote
0answers
91 views

What is the format of this binary file?

I have a binary file that I found on a 3D printer that is used to program a dsPIC30F5011 microcontroller. It is responsible for some basic data encryption. The only problem is, I am not sure how this ...
0
votes
1answer
103 views

Is this firmware using a substitution cipher?

I'm trying to extract data from a firmware file. I used binwalk on the firmware, which found a single chunk of Zlib compressed data. I uncompressed this data, and used strings on the result, which ...
3
votes
2answers
48 views

Finding a particular call to an offset within a vtable using pattern matching

Let's say I have a very simple pattern I'm looking for. E.g. the following regex, mov.*(eax|edx|ecx|esi|edi), \[(eax|edx|ecx|esi|edi)\+30h\] Now, I'm also looking for references to this in which the ...
1
vote
1answer
34 views

Why would an ELF SHT_REL section contain relocations outside the section its sh_info refers to?

I have a .so from an Android JNI/NDK application. Here are two of its sections: [Nr] Name Type Addr Off Size ES Flg Lk Inf Al [10] .rel.plt REL ...
1
vote
0answers
46 views

How to make sense of this one pin serial communication

I am trying to reverse engineer a serial communication between to microcontrollers (1 device & 1 microcontroller on a board). One MCU validates the other MCU and I want to crack the validation and ...
1
vote
0answers
121 views

Unknown Game Client Data

As asking a friend and no amount of Googling yielded an answer, I figured I'd make an account and give this place a go. I'm working on reverse engineering the server for a relatively old game with no ...
4
votes
1answer
116 views

Is this Bignum multiplication of 2048 RSA number a Montgomery multiplication?

The below code snippets are some kind of bignum multiplications involving 2048bit numbers, possibly in the context of RSA decryption. Does any one recognize this pattern? Is it maybe some kind of ...
3
votes
1answer
100 views

What are the popular machine learning unsupervised approaches to learning binary data representations?

This is somewhat open-ended question, so bear with me please. Be it a binary payload that you pull from network packet, firmware blob you pull of some EPROM or data intercepted straight from physical ...
3
votes
1answer
94 views

What are the steps to reverse engineering a Shockwave .DCR file?

I have been fascinated by reverse engineering after making several emulators and finding the pret community. I love the idea behind decompiling old games and recreating source code that recompiles ...
3
votes
2answers
183 views

Is pointer decryption possible?

I’m pretty new to reverse engineering, so bear with me... I’m trying to get a few struct definitions (or whatever they’re called) from this one binary. After some time fiddling around with it, I’ve ...
0
votes
0answers
40 views

Identify variable length header encoding

I have a file generated by Microsoft OneNote Online service. It contains a lot of attached binary files and I need to extract all of them. All attachments are stored inside the file in the following ...
-3
votes
1answer
204 views

Identification of AES portion code in binary

I want to locate AES code portion in binary after reverse engineering. I have tried to locate manually and using plugin findcrypt2 but I was not successful. Kindly show me a direction so that I can ...
1
vote
1answer
236 views

r2pipe won't prompt for user input like the binary does in r2 debugger mode

Have a functioning r2pipe script, but there's a need for hitting crtl-c to continue near the breakpoint(not a major issue,) however the script does not pause for input when the crackme asks for user ...
0
votes
1answer
131 views

how to understand branch arm instruction

I have this instruction F6F700B8 I know that it b #-0xA000 but how I can understand from F6F700B8 that is b #-0xA000 ? . When I tried to translate it on http://armconverter.com/hextoarm/ I get B.W #...
1
vote
2answers
60 views

How is the IV generated from a timestamp based on this function?

Background: I am currently looking to make some diagnostic software interoperable with other software, but all communication that occurs in this software is encrypted with AES-128-CBC. A sample ...
1
vote
1answer
269 views

bypassing anti-VM inside protected samples

This is a good starting point. As you know: Sandboxes and virtual environments (hypervisors) are full of artifacts that betray their analysis environment. Malware can protect itself against these by ...
0
votes
1answer
127 views

IDA Pro Address doesn't correlate to Immunity Debugger address

I'm trying to use immunity debugger to step through a confusing binary. When I open it in IDA Pro, I see certain addresses next to the instructions: .text:01001392 inc eax When I ...
7
votes
2answers
496 views

Radare2 Find command line arguments and location in stack

This might have a simple solution but I can't find it anywhere. $> ./be1 11 AAAAA With gdb, finding argv[] and argc is simple: (gdb) print argv[0]@argc $7 = {0xbffff872 "be1", 0xbffff89a "11", ...
-1
votes
1answer
43 views

Understanding what is represented by function pointers to a block of hex

I'm working on a disassembly project for my class where I'm trying to bypass a license check, but when I throw the executable into Binary Ninja this is what I see: And when I look at those pointers, ...
0
votes
1answer
41 views

Ldr arm thumb2 must be multiple of 4?

I saw here http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0489c/CIHDGFEG.html that on arm thumb2 ldr must be multiple of 4. I run on arm thumb 2 and want run this instruction ldr r0, ...
5
votes
0answers
154 views

How to find if a given library function is used in a binary?

Assuming that library X is statically linked, is there a way to know with an acceptable grade of confidence if a function from it was used in the binary? I am currently using this approach: Convert ...
0
votes
1answer
84 views

Arm function save registers r0 and r1

I see arm 32 bits assembly code. Usually each function do push { r4-r9,lr} ( save 6 registers on stack ). And in the end of function pop them . I see function that save push {r0,r1,r4-r9,lr} but ...
0
votes
2answers
175 views

How to obtain memory address of string literal?

I am trying to find where a specific string literal is used in a compiled program. I have already found the location of this string literal within the executable; I want to somehow deduce what the ...