Questions tagged [binary-analysis]
The process of gathering information about a binary file, either with static or dynamic methods.
1
vote
1answer
67 views
Which file system is this? file type 0x00, folder type 0x01
Inside a internet radio firmware file I found a file system, and I don't know which one it is.
What I know:
(The first two bytes are 0A 4C (maybe magic byte))
they are actually not part of the file ...
2
votes
1answer
56 views
GetProcAddress with 0 as lpProcName
I'm reversing a 32bit binary for a challenge I got at a college lab and I'm having a hard time trying to understand the intent of the asm code.
The binary is a 10 level reversing game where you get ...
0
votes
0answers
38 views
unsquashfs failed to read SquashFS file
I tried to unpack binary which is SquashFS system, the file is mtd partition copied from NAND device, Root filesystem (read-only). Actually its SquashFS version, modifyed/patched by vendor.
binwalk ...
1
vote
0answers
56 views
Using IDA to find pointer passed to procedure
Loading the source into IDA, I have this function:
According to the source for Lua, this function should be passed a pointer to the Lua_State struct:
LUA_API int lua_gettop (lua_State *L) {
return ...
0
votes
0answers
53 views
How to extract DVB firmware bin file?
I have a bin file of DVB(DTH) box firmware I want to change one image inside that bin file how I can do this please guide me in right direction. I tried bin walk but the file that it extracted ...
0
votes
0answers
34 views
what is Ida Name Tab
I know what is Function tab (show all function) and what is String tab(show all string) and Import , Export ....
But what is Name tab? what should I expect see there? and how Ida get this information ...
0
votes
1answer
81 views
How to find out address in binary file (like IDA) with python code only?
I have binary for example https://github.com/andrew-d/static-binaries/blob/master/binaries/linux/x86_64/nmap that I open with IDA , and search some data that I want to find without open IDA ,only ...
0
votes
1answer
60 views
Ida - what is Parse C header file
In ida File->Load file there is option Parse C header file, I want to understand that .
If I have the headers file that compiled with my binary I can attach and then see all the structures/function ...
0
votes
1answer
56 views
How to find the starting address of main function when the binary is stripped and _start doesn't push the absolute address value of main?
So let's say the ELF binary is stripped - meaning no symbol table - and the _start function doesn't push the address of main before calling __libc_start_main.
This happened in a binary when compiled ...
2
votes
2answers
157 views
Unable to extract IP camera firmware
I am trying to extract the firmware for a Panasonic WV-S2131L ip camera. It comes as a .zip file that contains a .img file. I have tried many methods to try to analyze this file and I have found ...
1
vote
0answers
37 views
How to find the index of static ilbrary functions in the PLT of the binary?
So right now I'm trying to resolve function calls and their names in my reversing tool
the problem I'm having is that library functions such as printf and fwrite and such do not have a corresponding ...
0
votes
1answer
60 views
What type of function gets called using a register instead of address in the binary? how to find the address statically?
So I'm trying to write a reversing tool right now and trying to make a CALL graph
the problem I'm having is some calls are like Call *eax instead Call 'address'
I can easily generate the call-graph ...
0
votes
1answer
84 views
How to split ARM code/data from binary in Inmarsat Isatphone Pro?
I'm analyzing the 3 binaries for updating firmware to the Inmarsat Isatphone Pro phone. Additionally, I'm following the Groundworks Technologies paper, and attempting to recreate their work as a ...
0
votes
1answer
32 views
me_cleaner and fwupd, or manipulating UEFI .cab files
I'd like to extract a plain dump of the UEFI firmware of my laptop (1:1 copy of the flash content, often called .bin or .rom files) from the .cap file, so that I can modify it slightly with me_cleaner....
4
votes
1answer
161 views
Can I define custom enum-type to be used in Ghidra as a data type?
I'm trying to learn Ghidra. Say, if it generated the following code for loading functions from an array of function names from gpfnCommCtrlAPI:
I was able to retype gpfnCommCtrlAPI into char*[14] ...
0
votes
1answer
51 views
Best python framework/library for constructing the call-graph from binary?
So i have written a python tool using capstone that disassembles the code section of a ELF binary using capstone.
now i want to also create and show the call-graph of this binary in a dot format, I ...
1
vote
1answer
42 views
View Array Type in dnSpy
I'm debugging a .NET application and see a declaration of a local array:
$ArrayType$$$BY05PAD $ArrayType$$$BY05PAD;
I break on an instruction that uses data inside that (char*) array:
num9 = <...
3
votes
0answers
290 views
How to load symbols from a symbol server in Ghidra?
I've been trying to learn Ghidra by attempting to reverse the comctl32.dll system library, which has many of its functions documented. I started the de-compilation analysis in it, and after a while it ...
1
vote
1answer
101 views
Decryption loops
I'm reversing a CTF binary and I found a decryption loop decompiled by IDA like this:
for ( i = 0; i < n; ++i )
{
v22 = *((_BYTE *)sub_5657D89B + i);
v0 = v22 ^ 0x90;
v1 = strlen(&...
1
vote
0answers
33 views
How do I decode arbitrary data from a raw extracted binary?
I have a IoT scale that stores my measurements into records and passes them onto my phone. I was able to read directly off a flash chip and create a binary file. The chipset is ARMv7.
I want to be ...
0
votes
0answers
47 views
Vulnerabilities of Binary executed by root
I was given a vulnerable 64bit dynamically linked stripped that runs simple checks to determine the strength of the passwords of users on a linux system.
The app checks if it the EUID is 0 and then ...
0
votes
1answer
93 views
x86-64 CALL opcode + disassembly
Working a basic buffer overflow on a 64bit system and putting together some basic shellcode. The main program does a call to puts@plt. When I disassemble main in gdb, the opcodes show as:
e8 6b fe ff ...
1
vote
0answers
62 views
Can anyone make much sense of this binary for an embedded system? [closed]
I want to see if anyone more experienced in reverse engineering and disassembly can take a look at this binary update file I have and maby ether help or just say if it is even possible to reverse it.
...
1
vote
1answer
109 views
Does a symbolic disassembler exist?
I would like to know if there are disassemblers based on a symbolic analysis, I'm beginner in RE, but I think that a disassembler based on symbolic techniques can be very interesting and could ...
0
votes
0answers
64 views
What is this function doing?
I have this function, named __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6__initEPKcm.
And this is the relevant assembly:
mov rdi, [rbp+var_A80]
mov rsi, [rbp+var_A88]
...
1
vote
0answers
71 views
REing GameCube model (GCR) and texture (GCT) formats
I'm attempting to reverse engineer the mesh and texture formats used by the 2005 GameCube game "TimeSplitters: Future Perfect". Unfortunately, I'm not nearly good enough at this kind of thing to ...
1
vote
1answer
71 views
When can trapping be used?
This is the beginning of one of the functions inside NTDLL of Windows XP:
MOV EDI,EDI
PUSH EBP
MOV EBP,ESP
...
The book on reverse engineering I am reading(Eldad Eilam - Reversing: Secrets of ...
1
vote
0answers
56 views
Argument types not identified when parsing declarations
I'm trying to add a dynamic import segment in the IDA database which contains functions names, and I'm applying type information to it, so that I can obtain argument locations by using ...
1
vote
2answers
60 views
Calculation with not defined variables?
I am new to reverse engineering and try to solve a crackme with radare2.
My problem is understanding of the following lines:
| 0x000007a9 c745b8000000. mov dword [var_48h], 0
| ...
2
votes
1answer
345 views
Extract a secret from an Android apk or .so file
Context
As an exercise I am researching all methods of hiding a secret in an android mobile app binary... Yes I know that with more or less effort they can always be extracted with static analyses, ...
0
votes
1answer
467 views
How to print the value of register with Radare 2
I am trying to solve this ELF - Ptrace challenge. I use Radare 2. This is the commands I execute to print the assembly code.
radare2 ch3.bin
[0x080482f0]> aaa
[[anal.jmptbl] Missing cjmp bb in ...
2
votes
1answer
94 views
Radare2 does not display the entire assembler code
I am trying to solve this ELF - Ptrace crack me. Here are the commands I use :
I start radare2 with the crack me as argument.
radare2 ch3.bin
I decide to go to the main and print the assembly code ...
0
votes
1answer
75 views
Combine various sub routines into one sub routine (IDA Pro)
Currently I am analyzing a .so file and there is a function which is supposed to be large (high number of nodes and edges). However, IDA Pro identified it as a small function, with various parts of ...
1
vote
2answers
128 views
Emotet invoice, what is the embedded file inside the word document
This pastebin hosts current URLs hosting the fake invoice of Emotet malware, which is the dropper part of the malware.
The document is a Office Open XML, and there are two large non textual segments ...
-1
votes
2answers
361 views
XOR encryption - How to find the key?
I'm trying to solve a crackme which basically uses a XOR encryption scheme in which the password is used as the key to an encrypted buffer which is subsequently executed. The following is the ...
1
vote
0answers
51 views
How can a segfault happen during the libc exit call on Linux?
I'm relatively new to reverse engineering, and I've decided to practise using the challenges from pwnable.tw. Currently, I am working on the "Silver Bullet" challenge.
While testing, I have noticed ...
2
votes
1answer
116 views
ROP chain: Buffer Overflow Return Pointer
I am trying to get a ROP exploit to work on Ubuntu 18.04 LTS 64bit.
I have a 64 bit binary (Nx enabled, ASLR disabled) with vuln function as follows:
public vuln
vuln proc near
var_100= byte ptr -...
1
vote
1answer
65 views
IDA - large jump table, missing cases in analysis
I have come across the following jump table with a large amount of cases (160+). There seems to be cases missing from IDAs analysis though. For example it skips from cases 22 -> 38 -> 91, and I can ...
0
votes
1answer
77 views
rip adress not visible with dr command
I just finished this challenge. This is the content of main function :
[0x08048a86]> pdf
/ (fcn) main 417
| main (int argc, char **argv, char **envp);
| ; var int local_16h @ ebp-0x16
|...
2
votes
1answer
68 views
Debug point not hit with radare2
I am doing this reverse engenering challenge. I executed theses commands to analyse the main function :
radare2.exe ch15.exe
aaa
s main
pdf
This is the output of the pdf command :
[0x004017b8]> ...
1
vote
2answers
148 views
Lots of mov instructions into ebp+offset - What is happening?
While learning RE I have come across this large segment of instructions that contains a majority of mov [ebp+offset], value instructions. I believe that ebp + offset are local variables? I think? ...
1
vote
1answer
222 views
How to reverse engineer a Black Box?
I am trying to reverse engineer / research a black box system, this is, a system for which there is no public information at all. Let's say the system is a modern handheld console.
I have already ...
0
votes
1answer
37 views
How to determine number and/or boundaries of linked object files in a PE generated by Visual Studio 6?
In this analysis of a Portable Executable linked using Microsoft Linker (6.0), down in the Imported Objects section, the website makes some very specific claims:
3 .OBJ Files (COFF) linked with LINK....
1
vote
1answer
58 views
What are those instructions doing?
I'm having a hard time figuring out whatever the hell this is doing.
mov rax, [rbp+var_720]
mov [rbp+var_458], rax
mov rax, [rbp+var_458]
mov [rbp+command_], rax
mov rax, [rbp+...
0
votes
1answer
90 views
How do I interpret the mangled functions name?
I am going to start by saying that this is my fourth attempt at reverse engineering a crackme and I'm starting to understand how assembly works, which is cool. I am sorry if this question is wrong or ...
0
votes
1answer
155 views
pwntools shellcode narnia2
I'm trying to solve the narnia2 challenge on overthewire.
I read a guide for help and managed to overwrite the stack with A's using some python
$(python -c "print 'A'*132 + '\xef\xbe\xad\xde'")
...
1
vote
1answer
408 views
Impossible to execute a program with radare2 : TO DO continue
I am trying to crack a crackme. I already catch the flag because I seen the string variable which represants flag. I would like to catch the flag on an other way, I want to set a breakpoint when there ...
0
votes
1answer
71 views
Why can't I decode this UART signal?
I have a modem that I'm trying to get into. It's composed of two SoCs, both with UART headers. I was already successful trying to connect to the first SoC's UART, with my USB-to-UART CP2102 decoder ...
1
vote
1answer
186 views
Analyze all functions with radare2
I have a big library in which IDA found ~84300 functions but using aa in radare2 I was just able to found ~3000.
I tried setting anal.hasnext to true, anal.from and anal.to to the start and the end ...
0
votes
2answers
303 views
Basic Blocks and Data Flow Analysis
I am looking to do some Data Flow Analysis via code. I have already the code that parses a binary and disassembles it (x86/x64) and creates Basic Blocks.
Now what I would like to do is, for any Basic ...
