Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [binary-analysis]

The process of gathering information about a binary file, either with static or dynamic methods.

12
votes
1answer
11k views

Approach to extract useful information from binary file

The purpose of this question is to gain an understanding of the concepts behind reverse engineering and to understand what approaches may be taken to extract useful information from a binary file. I'...
20
votes
4answers
5k views

Tool or data for analysis of binary code to detect CPU architecture

Assuming that I have binary file with code for unknow CPU can I somehow detect cpu architecture? I know that it depends mostly on compiler but I think that for most of CPU architectures it should be ...
46
votes
7answers
22k views

how can I diff two x86 binaries at assembly code level?

I'm looking for a tool like Beyond Compare, meld, kdiff, etc. which can be used to compare two disassembled binaries. I know that there's binary (hex) comparison, which shows difference by hex values, ...
68
votes
2answers
52k views

What is PLT/GOT?

From time to time, when disassembling x86 binaries, I stumble on reference to PLT and GOT, especially when calling procedures from a dynamic library. For example, when running a program in gdb: (gdb)...
13
votes
5answers
993 views

How do you store your data about a binary while performing analysis?

Since now, when I am analyzing a binary, I'm using a "pen and paper" method to locate the different location of the function, the different type of obfuscations, and all my discoveries. It is quite ...
12
votes
3answers
5k views

How to generate the call graph of a binary file?

I have a non-stripped ELF binary for which I want to create a call graph as a dot file. Is there such a tool which generates the call graph? EDIT: Is there away in addition to the conventional call ...
9
votes
2answers
1k views

Protect data stored in binary

Let's say I've some function(i.e. hash function), that generates value from input seed and some precomputed hash values, that are stored somewhere in binary. What are the possible approaches for: ...
7
votes
1answer
2k views

Zte Reverse engineering config.bin file problem

I just got a Zte ZXHN F660 GPON ONT Wireless router with my optic fiber internet provided by my telecom provider. My first discovery was that the eth Lan ports are bricked wich means I can only use ...
6
votes
1answer
2k views

How to make radare2 work for a large binary?

I compiled cpython with debugging headers and I want to perform the following analysis using radare2. The problem I encounter is that it takes forever (at least 27 hours) to perform the aaa (...
3
votes
1answer
2k views

How to get the disassembly line without offset translations in IDAPython?

When I use GetDisasm()to get disassembly line, I find out that it will show some memory references as a variable name. For example, when raw assembly is: mov %r15, 0x20b062(%rip)` GetDisasm()'s ...
3
votes
1answer
446 views

Computing subtracted stack space for a function manually

Lets assume this function frame : How to calculate and check if subtracted stack space by line 3 is 58h ?: sub esp, 58h And this is the code, the compiler is also Dev C++: #include <stdio.h> ...
0
votes
2answers
181 views

How to identify the structure of this specific data file? [closed]

What is the structure of this database file from an old videogame? https://www.dropbox.com/s/ioe26pi3y1w3320/TMDATA1.S8?dl=0 Apologies in advance because fixing specific problems is not really the ...
53
votes
8answers
154k views

How do I reverse engineer .so files found in android APKs?

I know how to reverse engineer normal android APKs using tools like APK-tool anddex2jar but i don't know how to work with obfuscation. Can anyone help or atleast provide some pointers? I know this ...
41
votes
7answers
85k views

How to know in which language/technology program (.exe) is written?

How to understand if exe/dll is written in C++/.Net/Java or in any other language. I tried to use Dependency walker but not able to get required information.
12
votes
2answers
4k views

Code Coverage - Fuzzing

I have been fuzzing Adobe Reader lately. One of the issues that I face is Code coverage. How do I determine that I have covered all the basic blocks in Adobe Reader and it's libraries. Is there any ...
5
votes
3answers
3k views

Is learning assembly enough to become a malware analyst? [closed]

I am a C/C++ developer and I have started learning assembly language programming with the goal to become a malware analyst. I know it is not enough to just know how to read assembly to become a ...
14
votes
2answers
3k views

Why are GOT and PLT still present in Linux static stripped binaries?

I am looking at statically linked linux x86 stripped binary. I noticed that there are .got and .plt sections. I wonder what does a statically linked binary need got and plt sections for ? Anyone ?
9
votes
2answers
7k views

How do you can you disassemble and dump an entire binary?

It's easy to seek to a particular function and dump it's contents as Assembly language. However, I cannot find an obvious way to immediately disassemble and dump an entire binary. I want to use it ...
7
votes
1answer
3k views

Unpack IpCam firmware - Binwalk extraction issue

I'm trying to use Binwalk to extract an IpCam bin firmware. I did it successfully for the WebUI, but I can't on the firmware itself. Hardware : Vstarcam C7824WIP Firmware : CH-sys-48.53.64.67.zip ...
3
votes
2answers
1k views

Automated Assembly/Disassemble library

I'm writing a handy reverse tool in C++ with manual assembling/disassembling shell, to automate my work! I need an assembler library. Is there any library, embedding in C++?
7
votes
4answers
1k views

Is there any tool to quantitatively evaluate the difference of binary?

I know some binary diff tool like VBinDiff and others. Currently I have a large number of binary, around 500. So I am looking for a binary tool to quantitatively evaluate the difference of binaries.....
3
votes
2answers
218 views

Arm ldr diffrent between # and =

In ARM assembly, what is the difference between ldr r4, =0x44454433 and ldr r4, #0x44454433 ?
2
votes
2answers
9k views

What's the difference between a disassembler, debugger and decompiler?

I have heard of disassemblers like IDA and debuggers like OllyDbg but honestly, when you give both of them a binary file it gives me the assembly code. I know that the decompiler gives the source code ...
1
vote
1answer
1k views

Router firmware modification and MIPS executable under x86_64 Ubuntu [X-POST from unix.stackexchange.com]

X-POST FROM unix.stackexchange.com I'm currently trying to make modifications to a router firmware: Swisscom Centro Grande - aka Pirelli Vx226N1, firmware version: 60200. I've decompiled it ...
6
votes
3answers
2k views

Running a binary identified as an ARM excutable by binwalk --disasm

I have a Philips 10FF2 picture frame I'm trying to reverse engineer. In the firmware download from the Philips website (http://download.p4c.philips.com/files/1/10ff2cme_00/10ff2cme_00_fus_aen.zip) I ...
4
votes
1answer
265 views

Reverse Engineering bios of ATM Machine

I bought an Hyosung NH1500 off Offer-up and it boots up and initializes some peripherals and then spits out and error of "COM download is failed". I've searched Google and 0 results came up, I've been ...
3
votes
0answers
805 views

Analysing eCos image

I'm working on unpacking a firmware image. I've already uncompressed the original image, but I'm stuck in the current step. This is the current uncompressed image: https://www.dropbox.com/s/...
6
votes
1answer
849 views

Reversing simple message + checksum pairs (32 bytes)

I am trying to determine the algorithm behind a 32-byte protected section of memory on a big-endian system. It will render invalid if even a single bit is changed, but I can generate any number of ...
4
votes
1answer
3k views

Find file signatures inside an unknown file

I have a .bin file I would like to analyse. Especially find images embedded in this firmware update. binwalk couldn't find anything. What other tools do you know to search for possible embedded ...
3
votes
1answer
282 views

How can the problem posed for disassembly by the admixture of executable code and literal pools in ARM firmware be overcome?

It's probably too soon for me to ask about this since I'm not familiar with ARM but it's been bothering me for a while now so I'm going to ask anyway. Context and Background Information Part 1: ARM ...
3
votes
0answers
593 views

Reverse engineer TPMS sensor data

I'm trying to reverse engineer data received from TPMS (car tire pressure) sensors. I was able to receive and demodulate the data (433 MHz, FSK, Manchester encoding). Probable packet fields: ...
3
votes
3answers
693 views

Finding end of file

I have got a file which contains other files. I know where the subfiles start (header) but how do I know where the subfiles end ? Edit: Files are like: sound files (.wav) and images (.bmp, png, jpeg) ...
2
votes
1answer
1k views

idapython find functions that contain a loop

How can I color functions that contain loops in IDApython ? If the end of the basic block can jump to start of basic block it's good enough, even in the rare case this is not a loop. But how do i ...
2
votes
1answer
512 views

Analyzing a Login Process

I am reverse engineering a program that uses a custom auth protocol. This is a basic outline of the process: Client takes input for username and password, then sends username to the auth server. Auth ...
1
vote
1answer
385 views

How can I change the values in esp?

0x08048785 <+344>: movl $0x0,0xc(%esp) 0x0804878d <+352>: movl $0x804896c,0x8(%esp) 0x08048795 <+360>: movl $0x8048973,0x4(%esp) 0x0804879d <+368>: movl ...