Questions tagged [binary-analysis]
The process of gathering information about a binary file, either with static or dynamic methods.
50
questions
138
votes
2
answers
122k
views
What is PLT/GOT?
From time to time, when disassembling x86 binaries, I stumble on
reference to PLT and GOT, especially when calling procedures from a
dynamic library.
For example, when running a program in gdb:
(gdb)...
- 18.8k
92
votes
9
answers
299k
views
How do I reverse engineer .so files found in android APKs?
I know how to reverse engineer normal android APKs using tools like APK-tool anddex2jar but i don't know how to work with obfuscation. Can anyone help or atleast provide some pointers? I know this ...
- 1,195
18
votes
1
answer
23k
views
Approach to extract useful information from binary file
The purpose of this question is to gain an understanding of the concepts behind reverse engineering and to understand what approaches may be taken to extract useful information from a binary file.
I'...
- 195
61
votes
8
answers
37k
views
how can I diff two x86 binaries at assembly code level?
I'm looking for a tool like Beyond Compare, meld, kdiff, etc. which can be used to compare two disassembled binaries. I know that there's binary (hex) comparison, which shows difference by hex values, ...
- 4,755
25
votes
6
answers
8k
views
Tool or data for analysis of binary code to detect CPU architecture
Assuming that I have binary file with code for an unknown CPU, can I somehow detect the CPU architecture? I know that it depends mostly on the compiler, but I think that for most CPU architectures it ...
- 385
13
votes
5
answers
1k
views
How do you store your data about a binary while performing analysis?
Since now, when I am analyzing a binary, I'm using a "pen and paper" method to locate the different location of the function, the different type of obfuscations, and all my discoveries. It is quite ...
- 18.8k
18
votes
4
answers
15k
views
How to generate the call graph of a binary file?
I have a non-stripped ELF binary for which I want to create a call graph as a dot file. Is there such a tool which generates the call graph?
EDIT: Is there away in addition to the conventional call ...
- 667
11
votes
2
answers
2k
views
Protect data stored in binary
Let's say I've some function(i.e. hash function), that generates value from input seed and some precomputed hash values, that are stored somewhere in binary. What are the possible approaches for:
...
- 823
10
votes
1
answer
6k
views
How to make radare2 work for a large binary?
I compiled cpython with debugging headers and I want to perform the following analysis using radare2.
The problem I encounter is that it takes forever (at least 27 hours) to perform the aaa (...
- 667
9
votes
3
answers
10k
views
Extracting a NAND flash dump with OOB data
I'm trying to extract a NAND flash dump of an old Walkman player. The dump was done by a friend and unfortunately cannot be redone because the chip was destroyed.
The dump was supposed to be just user ...
- 36.2k
4
votes
1
answer
5k
views
How to get the disassembly line without offset translations in IDAPython?
When I use GetDisasm()to get disassembly line, I find out that it will show some memory references as a variable name.
For example, when raw assembly is:
mov %r15, 0x20b062(%rip)`
GetDisasm()'s ...
- 115
3
votes
2
answers
2k
views
Automated Assembly/Disassemble library
I'm writing a handy reverse tool in C++ with manual assembling/disassembling shell, to automate my work!
I need an assembler library.
Is there any library, embedding in C++?
- 291
3
votes
1
answer
723
views
Computing subtracted stack space for a function manually
Lets assume this function frame :
How to calculate and check if subtracted stack space by line 3 is 58h ?: sub esp, 58h
And this is the code, the compiler is also Dev C++:
#include <stdio.h>
...
- 139
0
votes
1
answer
906
views
How do I interpret the mangled functions name?
I am going to start by saying that this is my fourth attempt at reverse engineering a crackme and I'm starting to understand how assembly works, which is cool. I am sorry if this question is wrong or ...
- 171
0
votes
2
answers
340
views
How to identify the structure of this specific data file? [closed]
What is the structure of this database file from an old videogame? https://www.dropbox.com/s/ioe26pi3y1w3320/TMDATA1.S8?dl=0
Apologies in advance because fixing specific problems is not really the ...
- 101
62
votes
7
answers
17k
views
Visualizing ELF binaries
I recently saw an older talk by Sergey Bratus and Greg Conti by the name of Voyage of the Reverser: A Visual Study of Binary Species.
Are there any opensource/free tools that one could use to see ...
user1743
56
votes
7
answers
153k
views
How to know in which language/technology program (.exe) is written?
How to understand if exe/dll is written in C++/.Net/Java or in any other language. I tried to use Dependency walker but not able to get required information.
- 927
16
votes
3
answers
5k
views
Code Coverage - Fuzzing
I have been fuzzing Adobe Reader lately.
One of the issues that I face is Code coverage. How do I determine that I have covered all the basic blocks in Adobe Reader and it's libraries.
Is there any ...
- 595
12
votes
3
answers
9k
views
Reverse engineer an old DOS QBasic executable
I recently decided to try my hand at reverse engineer an old DOS text based game that was coded in QBasic.
I found some info online about old DOS games disassembly but mostly for Wacom compiled C/C++ ...
- 121
9
votes
2
answers
13k
views
How do you can you disassemble and dump an entire binary?
It's easy to seek to a particular function and dump it's contents as Assembly language. However, I cannot find an obvious way to immediately disassemble and dump an entire binary. I want to use it ...
- 1,236
8
votes
1
answer
1k
views
Reverse engineer TPMS sensor data
I'm trying to reverse engineer data received from TPMS (car tire pressure) sensors. I was able to receive and demodulate the data (433 MHz, FSK, Manchester encoding).
Probable packet fields:
bytes 1-...
- 253
8
votes
1
answer
5k
views
Zte Reverse engineering config.bin file problem
I just got a Zte ZXHN F660 GPON ONT Wireless router with my optic fiber internet provided by my telecom provider.
My first discovery was that the eth Lan ports are bricked wich
means I can only use ...
7
votes
2
answers
21k
views
What's the difference between a disassembler, debugger and decompiler?
I have heard of disassemblers like IDA and debuggers like OllyDbg but honestly, when you give both of them a binary file it gives me the assembly code. I know that the decompiler gives the source code ...
- 1,195
7
votes
4
answers
2k
views
Is there any tool to quantitatively evaluate the difference of binary?
I know some binary diff tool like VBinDiff and others.
Currently I have a large number of binary, around 500.
So I am looking for a binary tool to quantitatively evaluate the difference of binaries.....
- 2,465
7
votes
1
answer
4k
views
Unpack IpCam firmware - Binwalk extraction issue
I'm trying to use Binwalk to extract an IpCam bin firmware. I did it successfully for the WebUI, but I can't on the firmware itself.
Hardware : Vstarcam C7824WIP
Firmware : CH-sys-48.53.64.67.zip
...
- 73
6
votes
3
answers
5k
views
Running a binary identified as an ARM excutable by binwalk --disasm
I have a Philips 10FF2 picture frame I'm trying to reverse engineer. In the firmware download from the Philips website (http://download.p4c.philips.com/files/1/10ff2cme_00/10ff2cme_00_fus_aen.zip) I ...
- 163
6
votes
1
answer
1k
views
Reversing simple message + checksum pairs (32 bytes)
I am trying to determine the algorithm behind a 32-byte protected section of memory on a big-endian system. It will render invalid if even a single bit is changed, but I can generate any number of ...
- 163
6
votes
1
answer
1k
views
I need quick correction on this x86 opcode conundrum
I am trying to figure out how to encode the instruction MOV DS, AX, but I am confused from the opcode table as follows:
Is MOV DS all one byte, or is MOV one byte, DS the second, and the AX the third?...
- 61
6
votes
2
answers
34k
views
Extract files from a bin firmware
I have a firmware image that is used for flashing a BMW NBT navigation system that I want to research. I did a binwalk on the file (dump below).
I want to extract the individual files, especially the ...
- 3,188
5
votes
1
answer
3k
views
Find file signatures inside an unknown file
I have a .bin file I would like to analyse. Especially find images embedded in this firmware update.
binwalk couldn't find anything.
What other tools do you know to search for possible embedded ...
- 3,059
5
votes
3
answers
4k
views
Is learning assembly enough to become a malware analyst? [closed]
I am a C/C++ developer and I have started learning assembly language programming with the goal to become a malware analyst.
I know it is not enough to just know how to read assembly to become a ...
- 927
5
votes
1
answer
5k
views
Find the C++ STL functions in a binary
I have a binary file (actually, an operating system for an ARM embedded device which also contains some high-level apps (hard coded in the user interface)).
I know some parts of the operating system ...
- 53
4
votes
1
answer
672
views
How can the problem posed for disassembly by the mixture of executable code and literal pools in ARM firmware be overcome?
Context and Background Information
Part 1: ARM firmware compared to firmware for other architectures
I looked at the ARM firmware in these two questions:
Running a binary identified as an ARM ...
- 7,058
4
votes
1
answer
580
views
Reverse Engineering bios of ATM Machine
I bought an Hyosung NH1500 off Offer-up and it boots up and initializes some peripherals and then spits out and error of "COM download is failed". I've searched Google and 0 results came up, I've been ...
- 43
4
votes
2
answers
311
views
What are the popular machine learning unsupervised approaches to learning binary data representations?
This is somewhat open-ended question, so bear with me please.
Be it a binary payload that you pull from network packet, firmware blob you pull of some EPROM or data intercepted straight from physical ...
- 143
4
votes
2
answers
1k
views
Locating Memory Allocation Functions from Static Analysis
I'm currently working on reversing a firmware binary for an embedded device. This device is using an uncommon architecture: it is a modified Harvard architecture, running on a TMS320C55x chipset with ...
- 397
3
votes
1
answer
807
views
How to add new language to ARM firmware
I have piece of firmware (download from here) and I need to get access to its filesystem.
Here is the output of a binwalk scan:
root@kali:~/Desktop/E1200YDXNB1_OLAANB1# binwalk --dd=".*" ps.bin
...
- 31
3
votes
0
answers
2k
views
Analysing eCos image
I'm working on unpacking a firmware image. I've already uncompressed the original image, but I'm stuck in the current step.
This is the current uncompressed image:
https://www.dropbox.com/s/...
- 31
3
votes
2
answers
1k
views
Arm ldr diffrent between # and =
In ARM assembly, what is the difference between
ldr r4, =0x44454433
and
ldr r4, #0x44454433 ?
- 49
3
votes
0
answers
581
views
Find constant variables with float values using Ghidra
I dumped an il2cpp.so with il2cppDumper and in the dump.cs I found that the variables I wanted to change its values are somewhat constant float. this is the snippet:
// Namespace:
public class ...
- 299
3
votes
1
answer
509
views
custom virtual machine protection
How someone would go to reverse engineer a sample protected with a virtual machine? The problem is that it's not opcode anymore it's bytecode which I don't have any idea about because it's a private ...
- 163
3
votes
3
answers
1k
views
Finding end of file
I have got a file which contains other files. I know where the subfiles start (header) but how do I know where the subfiles end ?
Edit: Files are like: sound files (.wav) and images (.bmp, png, jpeg)
...
- 33
2
votes
1
answer
2k
views
idapython find functions that contain a loop
How can I color functions that contain loops in IDApython ?
If the end of the basic block can jump to start of basic block it's good enough, even in the rare case this is not a loop. But how do i ...
- 21
2
votes
1
answer
895
views
Analyzing a Login Process
I am reverse engineering a program that uses a custom auth protocol. This is a basic outline of the process:
Client takes input for username and password, then sends username to the auth server.
Auth ...
- 151
1
vote
1
answer
3k
views
Way to get all the function prototype using Ghidra
I have been trying to extract the function prototypes from a binary file using Ghidra. Up till now what I have done was to use Ghidra's included "Decompile" script and filtered out the function ...
- 271
1
vote
2
answers
1k
views
Is it possible to reverse CGI binary file?
I wanna reverse CGI binary file.
Is it possible?
What are the recommended tools and guides?
Thank you for reading my question.
$ file test.cgi
status.cgi: ELF 32-bit LSB executable, ARM, EABI5 ...
- 109
1
vote
1
answer
876
views
Alternative to BinDiff that works on Linux x86_64 binaries (and preferably does not require IDA Pro)
Is there alternative to
https://www.zynamics.com/bindiff.html
that works for Linux x86_64 binaries, works on Linux, (and preferably does not require IDA Pro, however if needed it seems that IDA can ...
1
vote
1
answer
910
views
How can I change the values in esp?
0x08048785 <+344>: movl $0x0,0xc(%esp)
0x0804878d <+352>: movl $0x804896c,0x8(%esp)
0x08048795 <+360>: movl $0x8048973,0x4(%esp)
0x0804879d <+368>: movl ...
- 21
1
vote
1
answer
1k
views
Router firmware modification and MIPS executable under x86_64 Ubuntu [X-POST from unix.stackexchange.com]
X-POST FROM unix.stackexchange.com
I'm currently trying to make modifications to a router firmware: Swisscom Centro Grande - aka Pirelli Vx226N1, firmware version: 60200.
I've decompiled it ...
- 146
0
votes
0
answers
1k
views
Modify Strings in a ELF (Executable and Linking Format) that are stored in the .rodata
I have 2 ELF files here, each containing strings in the ".rodata" for an translation that I want to modify.
The first ELF "(binary1)" I have already successfully modified from ...
- 83