Questions tagged [binary-analysis]
The process of gathering information about a binary file, either with static or dynamic methods.
495
questions
0
votes
0answers
17 views
Binwalk, what's advantage of "Show results marked as invalid"?
I'm trying to understand -I option in binwalk. It provides some interesting output yet it isn't clear if these results are "invalid" or if they are valid results of a special type.
DECIMAL ...
1
vote
0answers
56 views
Extracting Binary Stream inside an mp3
In the song Chisel by Pruient there seems to be what sounds like a binary octet stream starting at 4:43.
The section of noise has distinct sections punctuated with momentary silence which leads me to ...
0
votes
1answer
50 views
How to exploit __isoc99_scanf with a segmentation fault
I'm an absolute newbie when it comes to all this side of reverse engineering. Each time I try and understand it, I get lost almost immediately.
I am trying a lab. I open it up in Binary Ninja. I get ...
1
vote
1answer
47 views
How to call a func in an executable binary?
I have a binary with a func that I can disassemble. What are simple ways for me to call it with arbitrary args and observe its return val and behavior?
Ideally, I'd like to do this:
Within gdb (or ...
0
votes
0answers
41 views
Reverse engineering STM32F303 firmware udpate
I have an .exe file, which connects via USB to a STM32F303 peripheral with unknown firmware. The .exe is able to update the STM32 firmware via the USB. The firmware update is also provided, and its ...
1
vote
1answer
121 views
Binary diff + patching across versions
What are the current options for binary patching which works across different versions of the binary?
E.g. we created a binary patch for a specific version of a binary and want to apply that patch to ...
1
vote
1answer
61 views
What is data only exploitation?
I was wondering, and after trying to read for the past several months I got totally lost and don't understand this concept. Could someone please explain in simple words the concept of data only ...
2
votes
1answer
60 views
When would a program normally transfer data between memory and coprocessor?
In the analysis of an ARM binary, when would one normally encounter transfer operations between memory and a coprocessor? These are encoded as the LDC and STC operators.
Would it be common for ...
0
votes
0answers
45 views
How do I view registers at a specific point of a binary's execution?
I have a binary that I'm attempting to reverse engineer to find a flag. From using ghidra I have found that the flag is stored in the program at a point called "check" and then run through ...
0
votes
0answers
80 views
Extract smartwatch firmware bin file
I'm trying to extract files from a bin file that's the firmware of a smartwatch.
I tried using
binwalk -Mre firmware.bin
but got no files, this is the result:
How should I extract/modify this bin ...
1
vote
2answers
99 views
Can't figure out a crash in IDA "The memory could not be read -> 00000710 (exc.code c0000005, tid 20612)"
I'm trying to debug out a game. Basically, the Steam version works perfectly but the GOG version (which is 8kb smaller) has an annoying problem where for some people (which happen to be me) the game ...
2
votes
1answer
146 views
Proprietary 3D Format Reverse Engineering: What Could These Numbers And Matrices Represent?
I'm trying to reverse engineer a model format from an older Russian game (Pathologic) with limited success. It is a proprietary model format not recognized by any converters/editing tools (believe me, ...
0
votes
1answer
59 views
string pointer to byte conversion condition
I am trying to understand the following snippet. I understand that the first check would check if it is even if it would be an int, but I don't understand it in this context.
Could someone explain to ...
0
votes
0answers
40 views
How to debug an unknown Tricore binary
I want to analyze a binary from a automotive ECU with an Infineon TC1797 Tricore processor. I can load it in Ghidra, and have analyzed and reverse-engineered a bit of code at the starting address. I ...
1
vote
0answers
55 views
Unknown binary format (.scp) - No Header
I hope everyone is doing well. I've recently been trying to decode the structure of some files that contain a lot Unicode-8 IIRC characters, with a mix of binary. When I put it into IDA, I can't seem ...
1
vote
0answers
33 views
How to find references for a string (where it is being called) in Go binary
I have a Go binary and I have this string:
When I go to its location, with IDA Pro, and tries to find all the references (using x) I am getting a message that there are no references:
It might be ...
0
votes
0answers
84 views
Inflate zlib Data Stream from Hex File
I am working on a firmware bin file that has been extracted from an EXE file. The Firmware was inserted as an encrypted PKZip resource in the EXE.
I was able to fish the EXE password at runtime and ...
2
votes
1answer
138 views
Reverse engineering Roland TR-8S kit file format .t8k
I'm trying to figure out the file format that the Roland TR-8S drum machine uses for importing/exporting drum kits. My goal is to replace the sample (PCM) data within a kit. It's a proprietary binary ...
0
votes
0answers
241 views
Extracting Userdata from Userdata.bin file backup of oneplus 7pro mobile
I have userdata backup file (Userdata.bin) of oneplus 7pro. I want to extract photos and videos from this. when i used the command "binwalk userdata.bin" it shows
DECIMAL HEXADECIMAL ...
1
vote
0answers
209 views
Repacking vmlinux into zImage/bzimage
While RE an embedded device I ran into a problem - I need to patch a check in the kernel which has no sources available. Unpacking the kernel and binary-patching went smoothly. However I cannot get ...
1
vote
2answers
193 views
Is it possible to reverse CGI binary file?
I wanna reverse CGI binary file.
Is it possible?
What are the recommended tools and guides?
Thank you for reading my question.
$ file test.cgi
status.cgi: ELF 32-bit LSB executable, ARM, EABI5 ...
2
votes
1answer
57 views
Reversing uboot on an aarch64 Hi3559AV target problems
I am trying to reverse uboot for an ARM aarch64 Hi3559AV target.
I've dumped the binary uboot.bin.gz, and have loaded it in IDA at the correct address. IDA seems to see a lot of strings (and ...
0
votes
2answers
152 views
Open unknown image format (probably a RAW image)
I copy image files here from a linux based system which ends with .bin.
Unfortunately I don't know how to open it. The goal is to convert images to this format later.
What I have already tried:
Open ...
0
votes
1answer
74 views
What character codes could these be?
Good day. I have these character codes in a binary file (Adobe After Effects Project) that represent a string. If I change them the text inside the application changes. However, for the life of me, I ...
0
votes
1answer
113 views
How to get the input necessary to get to the end
In short, I have a code that gets an input via stdin. Once it has the input string in memory, it verifies its integrity by calling a function for every condition, and exiting the program if those ...
0
votes
0answers
99 views
Reverse engineering encrypted router backup config file
My router has a config backup function that downloads a base64-encoded file.
After decoding the file, it's clear that it is encrypted:
I have tried redownloading the config, both after having changed ...
0
votes
0answers
97 views
Nokia 105(TA-1114) Firmware analysis using Binwalk
First please forgive me if a make any mistake. i am not a primarily English speaker but I will try my best.
Few days ago i started to tinkering with Nokia feature phone Nokia 105(TA-1114). I get a ...
-1
votes
1answer
96 views
Instrument memory accesses of python scripts
My research requires processing memory traces of applications. For C/C++ programs, this is easy using Intel's PIN library. However, as suggested here https://stackoverflow.com/questions/51835532/use-...
2
votes
0answers
78 views
How to modify checksum after making changes in Nokia 215 4G firmware?
If I change any character in the firmware file and try to flash it, it will failed. But it will successfully flashed if I changed the string with the same number of character if it's not a function.
...
0
votes
0answers
103 views
Help to find the main menu apps in Nokia firmware
I am trying to custom Nokia 215 4G firmware
I want to remove specific apps like games, radio, browser...
If not removing it, redirecting it OR even damage it. So when you click on an app it will open ...
1
vote
0answers
102 views
What type of file has the file signature 'BOOT'?
I have a .bin file which I am trying to disassemble into something that I can edit. Given that binary files can contain just about any binary data, I found it difficult to assess what file data is ...
0
votes
1answer
35 views
The Logic Of Incremental Data on Serial Communication Encoding
These are the serial communication reverse values.
I am trying to understand the logic behind this.
I am pretty sure that 2 bytes represent 1 byte(high byte and low byte), values are correct.
I tried ...
0
votes
0answers
53 views
Understand the AES encryption mode
I am reverse engineering a software that implements its own encryption over HTTP. The implementation is very simple, the client has the server's public key which it uses to encrypt the data it sends ...
1
vote
1answer
147 views
Arrays assembly
I'm reversing my C array's programs where I'm storing numbers in arrays like this...
int marks[5];
marks[0] = 1;
marks[1] = 3;
marks[2] = 2;
marks[3] = 7;
marks[4] = 9;
so the compiler showing me the ...
0
votes
1answer
83 views
Why compiler is doing this?
While I was disassembling my own C code for practice I saw an interesting point which I want to share with you guys and needs to know the answer as I always get from here. Now, the interesting point ...
0
votes
0answers
73 views
How to Find Password/ Bypass Password in a Switch Statement using IDA
I'm new to reverse engineering, wondering how access or bypass the password contained in the switch statement ?
File Link
2
votes
1answer
154 views
Not able to understand the C-switch statement in disassembly
While I'm trying to disassemble my own C code I am stuck in a problem of not understanding how this Switch statement is implemented in assembly code. Can anyone please help to figure it out? This the ...
0
votes
0answers
36 views
IDAPython NtCreateFile
Let's say I want to print the filenames on every call to NtCreateFile
(With %any% exe loaded in IDA )
The first problem is to get the ntdll!NtCreateFile address
Tried to do it like this ...
12
votes
4answers
4k views
Why do reversers nowadays reverse engineer using decompilers and not disassemblers?
I see many reverse engineering lessons and every second person does reverse engineer using Ghidra decompiler and not disassembler as both are available in the same platform. I assume that reversing ...
0
votes
0answers
134 views
Control flow graph of entire binary file
Is it possible to get the control flow graph of the entire binary file using any disassembler? IDA Pro generates the CFG for each function. Can we use it to get the CFG of the entire program?
0
votes
0answers
89 views
Possible ways to reverse enginerring the boot file
I am trying to take files from the file called LOADING.KWI
it is the boot file for multimedia, located on the loading sdhc card, which should be inserted in multimedia's slot, without this card the ...
0
votes
0answers
75 views
finding a not-so-straightforward game's function
I am working on Mad Max game [ APEX engine ]
I do my best to explain the situation.
so my target executes function like this:
there are commands like " call [eax+XX] " or " call RX &...
0
votes
1answer
36 views
How to force a program to run as monothread for dynamic analysis?
I'm reversing a program with x64dbg and ida (I switched from ghidra), hence disassembled and decompiled, I need to understand what is happening with dynamic analysis, but I have a tricky part where ...
3
votes
2answers
97 views
How to figure out functionality when doing Static Code Analysis in ASM?
When doing Static code analysis on a disassembled app, I usually end up seeing many calls to registers (CALL EAX for example), which is constructed in runtime, which leaves me clueless on how to ...
0
votes
1answer
134 views
How to export arm64 and x86-64 binary into one?
I am trying to export a binary that contains both AARCH64-64 and x86-64 in Ghidra. I only opened the x86-64 counterpart to perform some changes.
When I tried to export it, it exported a .bin file that ...
0
votes
1answer
64 views
IDAPython, parse IDA DB as PE file
I have buffer loaded into IDA with IDAPython in a costume loader script, I want to now to be parsed as a PE, or in fact, it would be better if IDA will try to reparse it as a PE, is it possible ...
0
votes
1answer
380 views
Advanced Binary Exploitation CTF
I wanted to ask your assistance: Where can I find advanced ctfs (that hopefully contain solutions) regarding binary/kernel exploitation? I am interested on finding x86_64 linux/windows/arm64 that ...
0
votes
1answer
59 views
usercalls in old Win32 game
I am currently analyzing an old Win32 game from 1999 that was probably compiled with Visual C++ 6 and was programmed in C.
I noticed that there are almost no usercalls (i.e. calls that use registers ...
2
votes
1answer
218 views
The Knowledge of Compiler for becoming a good Reverser
I just reached the the topic of Compilers in the book "Reversing:Secrets of Reverse Engineering" So, I want to ask, is the knowledge of Compilers necessary for becoming a Malware Reverse ...
1
vote
4answers
126 views
finding sequence of opcode in binary
I have dis-assmebled binary and want to check if it contains particular sequence of opcodes(obtained from other reference binary). how to do that . i know plain byte
level comparison wont work as as ...
