Questions tagged [binary-analysis]

The process of gathering information about a binary file, either with static or dynamic methods.

Filter by
Sorted by
Tagged with
0
votes
0answers
29 views

String as constant , even not visible in disassembler

I was reading this article Where I saw that while reversing the WinRAR I saw that the x64dbg is not able to search for a string in all modules "evaluation copy". but why is that happening. ...
0
votes
0answers
44 views

Modify Strings in a ELF (Executable and Linking Format) that are stored in the .rodata

I have 2 ELF files here, each containing strings in the ".rodata" for an translation that I want to modify. The first ELF "(binary1)" I have already successfully modified from ...
0
votes
1answer
41 views

Static Binary in Windows

I am learning more about binary exploitation on windows. But I saw while revering a binary that you can create static binaries in windows too just like in Linux. It was really ugly. if I would be on ...
-1
votes
0answers
29 views

String to instruction

I am more into reverse engineering more than binary exploitation. I like to bypass jump instruction. but sometimes, I get very frustrated when I don't find the jump instruction via a string. for ...
0
votes
1answer
26 views

How to find the file address of AddressOfEntryPoint

I have a binary file and in the optional header I have the address of the entry point 0x00011046 but when I put the file inside HEX editor this address doesn't exist, more than that 0x000097f0. I ...
5
votes
2answers
936 views

Difference between Main and Entry

Sometimes, I see while disassembling a binary that there is the main function. but sometimes, instead of main, there is entry function. I want to know what is the difference between entry and main.
0
votes
1answer
60 views

What should I learn in order to reverse elf64 binary files

I'm a little confused. I am using a Linux based system (Ubuntu), 64-bit. and I want to start and reverse 64elf binary files, but there is a lot of things I want to know before. just to be clear, If I ...
2
votes
1answer
119 views

How do we decompile java so easy?

I have seen a lot of videos where everyone is decompiling the jar files so easily. but I learnt that we cannot decompile any compiled file so easily. I have a little bit of experience in Gidhra. I ...
1
vote
1answer
62 views

Confusion between different ARM architectures

I am trying to develop a machine learning model to help with the process of reverse engineering. As the first stage, we are currently trying to train an embedding model that understand the ...
1
vote
1answer
61 views

Identifying the nature and contents of a file

As a preface, I do not have any experience in reverse engineering. I am an application developer, so this field is way out of my area of expertise. My end goal is to create a web page out of this ...
1
vote
1answer
187 views

How to extract information from a binary file knowing the target info

I have some measured data comes from a various types of sensors. The sensors are connected to a data-logger in order to store measurement data. After measurement, the data transported and stored in a ...
0
votes
2answers
76 views

How does an executable’s static API differ from it’s dynamic API?

Running an executable in Cuckoo sandbox gives me its dynamic API information. How do these API calls differ from their static API information (eg. If I were to just put the executable through IDA Pro ...
0
votes
1answer
73 views

How to find function start in stripped binary?

Given C code, are the function addresses from the ELF the same as those in the stripped version? I don't have any specific code in mind. Just trying to learn in general how to find the function ...
1
vote
0answers
29 views

PE Format - How can I delete IMAGE_IAT_DIRECTORY and the app still runs fine?

I’m doing a small research regarding PE files and while I drilled every related question or the documentation itself I couldn’t explain this issue. Why can I go to CFF explorer or some other PE ...
2
votes
1answer
80 views

Getting android app from device for reversing - what if there are multiple apks?

For analyzing and reversing android apps, where the target app is installed on an android phone, usually there is a base.apk file on the device, and there are various ways to find this apk file on the ...
5
votes
2answers
177 views

What kind of function creates this code pattern?

Apologies if this is a duplicate. Don't know what words to search for as that's what the question is about. I'm relatively new to reverse engineering binaries and while using Ghidra I've noticed that ...
3
votes
2answers
546 views

C++ Unary equals (unary operator=)

In C++ binaries, I find Qt methods like ??4QString@@QEAAAEAV0@AEBV0@@Z which demangle to public: class QString & __ptr64 __cdecl QString::operator=(class QString const & __ptr64) __ptr64 or ...
2
votes
1answer
81 views

How to set the type of a variable or function to an std::string?

I'm using IDA Pro and have identified a function that takes an std::string as an argument. However when I click on the function and "Set Item Type", entering its definition: std::__ndk1::...
0
votes
1answer
369 views

What does 'test al, al' mean?

I'm trying to reverse engineer a program and i found the following instruction: test al, al je label what does these two instruction do ? Can someone explain please ?
8
votes
0answers
124 views

Extracting strings from Go binaries

Is there an easy way to extract all of the strings from Go binaries that will work cross architecture? The problem with Go is that strings are stored without a null terminator so you can't use the "...
1
vote
0answers
49 views

What to do with a text file of disassembly code and binaries?

I am fairly new to software reverse engineering and I'd like to know how proceed with analyzing a program if I have a text file of disassembly code and a bin file of binary data. I understand ...
0
votes
0answers
52 views

Combine two ELF binaries

Without having access to the original source code, is there a way to combine two ELF binaries with the main() in the first binary pointing to the main() in the second binary ? In other words, I mean ...
0
votes
0answers
34 views

Is there any tool that finds common things like strings among large number of binaries?

So this is really needed in malware analysis, for example if i have 1000 samples from a family and i want to know which strings are common among all of them, it would really help to have a tool that ...
0
votes
0answers
97 views

How to reverse engineer Apple MacBook SMC update firmware image using IDA Pro 7.2?

Alright so I have watched extraordinary presentations videos from three different reverse engineers who hacked the Apple SMC Update firmware: Charlie Miller: https://www.youtube.com/watch?v=...
0
votes
0answers
69 views

How to force IDA to properly parse the ELF header?

Is possible to force IDA to parse the elf file into its appropriate fields without resorting to IDC/IDApython, I mean is there a built-in functionality that I'm missing? For instance it possible to ...
1
vote
0answers
30 views

dwarf: variable offset from base

I have a simple code: int main() { int a = 4; printf("%d\n", a); a = 8; if (a == 8) printf("%d\n", a); return 0; } DIEs for the function and variable: <1><32a>: Abbrev ...
0
votes
1answer
57 views

Need some help and advices as regards as reverse engineering IoT devices

Hi everyone, I saw this video on youtube as regards as reversing IPTV cameras and finding security vulnerabilities: Black Hat 2013 - Exploiting Network Surveillance Cameras Like a Hollywood Hacker I ...
0
votes
0answers
44 views

How can I reassemble a DDS header with the information I have?

I have 2 files which I know for certainty to be as follows: File 1: Includes all of the DDS image data File 2: Includes some data from the header. The data it includes is the width and the height (...
1
vote
1answer
76 views

Recognize binary architecture

I have binary that run on Arm Thumb cpu, in embedded devive that not running Linux. When I tried to run bimwalk or file ,and even open it with Ida ,but they didn't find out that this binary run on ...
0
votes
0answers
16 views

In Memory Function Enumeration

I tried to look around and find a way to automate function enumeration of a binary, process. To make things simple, what I am referring to is "normal usage" of a program, in windows. For instance: ...
1
vote
1answer
38 views

Can I make a DDS image from headerless DDS data?

I have some files which I've decrypted that I believe are DDS images. These files do not have a DDS header, however the data looks similar to what I've seen in other DDS images. I believe to a great ...
11
votes
2answers
2k views

What are some ways to pass raw bytes to a program via the Linux terminal?

I want to pass raw bytes to a (C) program using the Linux Bash shell. I find that when I try to pass for example "\x00\xFF\xAB", the program receiving the input actually gets the ASCII character codes ...
0
votes
1answer
65 views

Replace string in hexa with a longer one in .bin without destroying the structure (in .data)

I would like to replace some hard-coded strings in a compiled exe (in .data) which is in chinese (with no possibility to put it in other languages). I managed to replace strings in hexadecimal with ...
1
vote
0answers
44 views

Main contemporary deobfuscation techniques

Could you please specify in a few words main contemporary deobfuscation techniques which we can apply to 32/64 bit PE files? For example, (1) using instruction templates, such as: mov edx, 5B1F04F1h ...
-1
votes
1answer
192 views

Getting the function's original file name within Ghidra

I am trying to extract the original file name of some functions through Ghidra. In particular I have enabled the debug symbols so that it does contains the function names in the disassembly listing ...
3
votes
2answers
205 views

Function prototypes given by Ghidra is not consistent

This is a follow up question to the question I posted over here. According to the answer, I was able to get all the function prototypes from the binary. However, the problem I am having is most of the ...
1
vote
1answer
204 views

Way to get all the function prototype using Ghidra

I have been trying to extract the function prototypes from a binary file using Ghidra. Up till now what I have done was to use Ghidra's included "Decompile" script and filtered out the function ...
0
votes
0answers
59 views

Jump without jmp near

I need to jump a Hello, I need to jump some lines that lock program in a loop status. i use process hacker to find lines with string in binary but when i find this lines i have not jumps near, in ...
0
votes
1answer
50 views

In IDA, cannot find xrefs to string in ARM little-endian bootloader/firmware

In this firmware that is ARM Little endian. There is two strings : 0x00006953 : Foretrex 701 0x00006960 : Foretrex 601 The issue, is there is no direct Xreft to any of thoses strings ? For the ...
0
votes
1answer
40 views

Convert series of hex digits represented as ASCII-characters stored in a .txt file to raw bytes

I recently extracted a bunch of raw bytes (from wireshark) into a regular .txt file. Because these raw bytes are stored in a text file, all those hex-digits are actually written as ASCII characters ...
0
votes
0answers
40 views

Identify encrypt /decrypt rsa function

I have arm static binary that I know it use RSA. How can I find the encrypt/decrypt function?
3
votes
3answers
420 views

Way to get basic blocks of a binary using Ghidra

I am using ghidra to do some reverse engineering of an ARM binary. I am wondering whether there is a way to get the basic blocks related to all the listing. Is there a function through the IDE or a ...
1
vote
2answers
65 views

Gui disabled program functionality

Right now I'm performing analysis of a GUI based application and I'm trying to determine all of it's available functionality. Right now there's one button remaining labeled "Encrypt", which is greyed ...
0
votes
1answer
178 views

Dumping the GOT with gdb at run time

I want to see how the plt stubs are being resolved at run time when lazy linking is used and how the GOT is changed along the way. How can I dump the GOT with gdb?
3
votes
1answer
88 views

Review a collection of executable binaries to determine similarity

I have a collection of different binaries I want to review for code similarity and classification, but I would rather not have to open each of them in IDA and manually review the code in 15 different ...
1
vote
0answers
14 views

Locating Exit/Abort Functions from Static Analysis

Similar to this question, I'm interested in locating exit and abort style functions in a firmware - any function call that in fact terminates the execution, by statically analyzing the firmware. My ...
0
votes
1answer
152 views

Extracting functions of .obj file (compiled by myself with Visual Studio 19) --> extracts wrong data

How can I find only real functions not data garbage like section..debug_S_105 ? * I need to collect function data (assembler code) of Open Source C++ Files which I compile with Visual Studio 19 (sln ...
0
votes
0answers
156 views

reversing xiaomi update firmware encrypted?

I am playing around with a xiaomi firmware [mijia_4k_0.6.16.02] for a camera Running binwalk on the file I see this output DECIMAL HEXADECIMAL DESCRIPTION ----------------------------------...
1
vote
1answer
80 views

empty .data section in AARCH64 elf binaries

My question is: Why does readelf -x .data bin.so give me empty data when ghidra does not? (0x00 repeated for section length until last element 0xFFFFFFFF). ghidra/JEB contradict me by showing that ...
0
votes
1answer
85 views

Questions regarding PLT/GOT and statically linking

I am looking at the assembly code of a heap-overflow challenge (heap3 in Protostar) which uses a vulnerability of an old version of dlmalloc to execute the exploit. Below is the assembler dump: ...

1
2 3 4 5
9