Questions tagged [binary-analysis]
The process of gathering information about a binary file, either with static or dynamic methods.
447
questions
3
votes
1answer
125 views
Confusing syntax found in malware
I am confused by what the following command is doing:
00401234 mov dword [esp+0x35], sub_408678
For context, I'm reversing a piece of malware and am using Binary Ninja, which to my knowledge ...
0
votes
0answers
26 views
Radare2: Running executable from a specific point
I am using radare2 to reverse engineer a standard crackme executable. I have obtained the password, but now I need use the program to read & print a restricted file to which the executable has ...
1
vote
1answer
63 views
Statically Reverse Engineering Shellcode - IDA to Ghidra
I'm trying to follow along with this tutorial which is using IDA in it's example. https://0ffset.net/reverse-engineering/malware-analysis/common-shellcode-techniques/
Hash: ...
0
votes
0answers
35 views
String as constant , even not visible in disassembler
I was reading this article Where I saw that while reversing the WinRAR I saw that the x64dbg is not able to search for a string in all modules "evaluation copy". but why is that happening. ...
0
votes
0answers
73 views
Modify Strings in a ELF (Executable and Linking Format) that are stored in the .rodata
I have 2 ELF files here, each containing strings in the ".rodata" for an translation that I want to modify.
The first ELF "(binary1)" I have already successfully modified from ...
0
votes
1answer
49 views
Static Binary in Windows
I am learning more about binary exploitation on windows. But I saw while revering a binary that you can create static binaries in windows too just like in Linux. It was really ugly. if I would be on ...
0
votes
2answers
64 views
How to find the file address of AddressOfEntryPoint
I have a binary file and in the optional header I have the address of the entry point 0x00011046 but when I put the file inside HEX editor this address doesn't exist, more than that 0x000097f0.
I ...
5
votes
2answers
949 views
Difference between Main and Entry
Sometimes, I see while disassembling a binary that there is the main function. but sometimes, instead of main, there is entry function.
I want to know what is the difference between entry and main.
0
votes
1answer
65 views
What should I learn in order to reverse elf64 binary files
I'm a little confused. I am using a Linux based system (Ubuntu), 64-bit. and I want to start and reverse 64elf binary files, but there is a lot of things I want to know before. just to be clear, If I ...
2
votes
1answer
127 views
How do we decompile java so easy?
I have seen a lot of videos where everyone is decompiling the jar files so easily. but I learnt that we cannot decompile any compiled file so easily. I have a little bit of experience in Gidhra. I ...
1
vote
1answer
63 views
Confusion between different ARM architectures
I am trying to develop a machine learning model to help with the process of reverse engineering. As the first stage, we are currently trying to train an embedding model that understand the ...
1
vote
1answer
64 views
Identifying the nature and contents of a file
As a preface, I do not have any experience in reverse engineering. I am an application developer, so this field is way out of my area of expertise. My end goal is to create a web page out of this ...
1
vote
1answer
196 views
How to extract information from a binary file knowing the target info
I have some measured data comes from a various types of sensors. The sensors are connected to a data-logger in order to store measurement data. After measurement, the data transported and stored in a ...
0
votes
2answers
76 views
How does an executable’s static API differ from it’s dynamic API?
Running an executable in Cuckoo sandbox gives me its dynamic API information. How do these API calls differ from their static API information (eg. If I were to just put the executable through IDA Pro ...
0
votes
1answer
78 views
How to find function start in stripped binary?
Given C code, are the function addresses from the ELF the same as those in the stripped version?
I don't have any specific code in mind. Just trying to learn in general how to find the function ...
1
vote
0answers
29 views
PE Format - How can I delete IMAGE_IAT_DIRECTORY and the app still runs fine?
I’m doing a small research regarding PE files and while I drilled every related question or the documentation itself I couldn’t explain this issue.
Why can I go to CFF explorer or some other PE ...
2
votes
1answer
84 views
Getting android app from device for reversing - what if there are multiple apks?
For analyzing and reversing android apps, where the target app is installed on an android phone, usually there is a base.apk file on the device, and there are various ways to find this apk file on the ...
5
votes
2answers
189 views
What kind of function creates this code pattern?
Apologies if this is a duplicate. Don't know what words to search for as that's what the question is about.
I'm relatively new to reverse engineering binaries and while using Ghidra I've noticed that ...
3
votes
2answers
550 views
C++ Unary equals (unary operator=)
In C++ binaries, I find Qt methods like ??4QString@@QEAAAEAV0@AEBV0@@Z which demangle to
public: class QString & __ptr64 __cdecl QString::operator=(class QString const & __ptr64) __ptr64
or ...
2
votes
1answer
98 views
How to set the type of a variable or function to an std::string?
I'm using IDA Pro and have identified a function that takes an std::string as an argument.
However when I click on the function and "Set Item Type", entering its definition:
std::__ndk1::...
0
votes
1answer
642 views
What does 'test al, al' mean?
I'm trying to reverse engineer a program and i found the following instruction:
test al, al
je label
what does these two instruction do ? Can someone explain please ?
8
votes
0answers
139 views
Extracting strings from Go binaries
Is there an easy way to extract all of the strings from Go binaries that will work cross architecture?
The problem with Go is that strings are stored without a null terminator so you can't use the "...
1
vote
0answers
50 views
What to do with a text file of disassembly code and binaries?
I am fairly new to software reverse engineering and I'd like to know how proceed with analyzing a program if I have a text file of disassembly code and a bin file of binary data. I understand ...
0
votes
0answers
52 views
Combine two ELF binaries
Without having access to the original source code, is there a way to combine two ELF binaries with the main() in the first binary pointing to the main() in the second binary ?
In other words, I mean ...
0
votes
0answers
34 views
Is there any tool that finds common things like strings among large number of binaries?
So this is really needed in malware analysis, for example if i have 1000 samples from a family and i want to know which strings are common among all of them, it would really help to have a tool that ...
0
votes
0answers
107 views
How to reverse engineer Apple MacBook SMC update firmware image using IDA Pro 7.2?
Alright so I have watched extraordinary presentations videos from three different reverse engineers who hacked the Apple SMC Update firmware:
Charlie Miller:
https://www.youtube.com/watch?v=...
0
votes
0answers
74 views
How to force IDA to properly parse the ELF header?
Is possible to force IDA to parse the elf file into its appropriate fields without resorting to IDC/IDApython, I mean is there a built-in functionality that I'm missing?
For instance it possible to ...
1
vote
0answers
30 views
dwarf: variable offset from base
I have a simple code:
int main()
{
int a = 4;
printf("%d\n", a);
a = 8;
if (a == 8)
printf("%d\n", a);
return 0;
}
DIEs for the function and variable:
<1><32a>: Abbrev ...
0
votes
1answer
60 views
Need some help and advices as regards as reverse engineering IoT devices
Hi everyone, I saw this video on youtube as regards as reversing IPTV cameras and finding security vulnerabilities: Black Hat 2013 - Exploiting Network Surveillance Cameras Like a Hollywood Hacker
I ...
0
votes
0answers
49 views
How can I reassemble a DDS header with the information I have?
I have 2 files which I know for certainty to be as follows:
File 1: Includes all of the DDS image data
File 2: Includes some data from the header. The data it includes is the width and the height (...
1
vote
1answer
86 views
Recognize binary architecture
I have binary that run on Arm Thumb cpu, in embedded devive that not running Linux.
When I tried to run bimwalk or file ,and even open it with Ida ,but they didn't find out that this binary run on ...
0
votes
0answers
16 views
In Memory Function Enumeration
I tried to look around and find a way to automate function enumeration of a binary, process.
To make things simple, what I am referring to is "normal usage" of a program, in windows. For instance: ...
1
vote
1answer
44 views
Can I make a DDS image from headerless DDS data?
I have some files which I've decrypted that I believe are DDS images. These files do not have a DDS header, however the data looks similar to what I've seen in other DDS images. I believe to a great ...
11
votes
2answers
2k views
What are some ways to pass raw bytes to a program via the Linux terminal?
I want to pass raw bytes to a (C) program using the Linux Bash shell. I find that when I try to pass for example "\x00\xFF\xAB", the program receiving the input actually gets the ASCII character codes ...
0
votes
1answer
69 views
Replace string in hexa with a longer one in .bin without destroying the structure (in .data)
I would like to replace some hard-coded strings in a compiled exe (in .data) which is in chinese (with no possibility to put it in other languages).
I managed to replace strings in hexadecimal with ...
1
vote
0answers
44 views
Main contemporary deobfuscation techniques
Could you please specify in a few words main contemporary deobfuscation techniques which we can apply to 32/64 bit PE files?
For example, (1) using instruction templates, such as:
mov edx, 5B1F04F1h
...
-1
votes
1answer
226 views
Getting the function's original file name within Ghidra
I am trying to extract the original file name of some functions through Ghidra. In particular I have enabled the debug symbols so that it does contains the function names in the disassembly listing ...
3
votes
2answers
257 views
Function prototypes given by Ghidra is not consistent
This is a follow up question to the question I posted over here. According to the answer, I was able to get all the function prototypes from the binary. However, the problem I am having is most of the ...
1
vote
1answer
230 views
Way to get all the function prototype using Ghidra
I have been trying to extract the function prototypes from a binary file using Ghidra. Up till now what I have done was to use Ghidra's included "Decompile" script and filtered out the function ...
0
votes
0answers
61 views
Jump without jmp near
I need to jump a
Hello,
I need to jump some lines that lock program in a loop status.
i use process hacker to find lines with string in binary but when i find this lines i have not jumps near, in ...
0
votes
1answer
54 views
In IDA, cannot find xrefs to string in ARM little-endian bootloader/firmware
In this firmware that is ARM Little endian.
There is two strings :
0x00006953 : Foretrex 701
0x00006960 : Foretrex 601
The issue, is there is no direct Xreft to any of thoses strings ?
For the ...
0
votes
1answer
41 views
Convert series of hex digits represented as ASCII-characters stored in a .txt file to raw bytes
I recently extracted a bunch of raw bytes (from wireshark) into a regular .txt file. Because these raw bytes are stored in a text file, all those hex-digits are actually written as ASCII characters ...
0
votes
0answers
41 views
Identify encrypt /decrypt rsa function
I have arm static binary that I know it use RSA.
How can I find the encrypt/decrypt function?
3
votes
3answers
476 views
Way to get basic blocks of a binary using Ghidra
I am using ghidra to do some reverse engineering of an ARM binary. I am wondering whether there is a way to get the basic blocks related to all the listing. Is there a function through the IDE or a ...
1
vote
2answers
65 views
Gui disabled program functionality
Right now I'm performing analysis of a GUI based application and I'm trying to determine all of it's available functionality.
Right now there's one button remaining labeled "Encrypt", which is greyed ...
0
votes
1answer
215 views
Dumping the GOT with gdb at run time
I want to see how the plt stubs are being resolved at run time when lazy linking is used and how the GOT is changed along the way. How can I dump the GOT with gdb?
3
votes
1answer
101 views
Review a collection of executable binaries to determine similarity
I have a collection of different binaries I want to review for code similarity and classification, but I would rather not have to open each of them in IDA and manually review the code in 15 different ...
1
vote
0answers
14 views
Locating Exit/Abort Functions from Static Analysis
Similar to this question, I'm interested in locating exit and abort style functions in a firmware - any function call that in fact terminates the execution, by statically analyzing the firmware.
My ...
0
votes
1answer
191 views
Extracting functions of .obj file (compiled by myself with Visual Studio 19) --> extracts wrong data
How can I find only real functions not data garbage like section..debug_S_105 ? *
I need to collect function data (assembler code) of Open Source C++ Files which I compile with Visual Studio 19 (sln ...
0
votes
0answers
171 views
reversing xiaomi update firmware encrypted?
I am playing around with a xiaomi firmware [mijia_4k_0.6.16.02] for a camera
Running binwalk on the file I see this output
DECIMAL HEXADECIMAL DESCRIPTION
----------------------------------...
