Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [binary-analysis]

The process of gathering information about a binary file, either with static or dynamic methods.

3
votes
1answer
383 views

Strange instructions pattern (lw) in MIPS binary

I'm trying to reverse a binary and I'm having trouble understanding a pattern that keeps showing in almost half of the functions in the binary. This is how one particular function looks like: Why is ...
1
vote
1answer
518 views

Rebuilding firmware back to binary file

I used Binwalk to extract firmware files, extracted content include 2 folders and one binary file. squashfs-root _351C.extracted 351C Squashfs-root contains file system, '_351C.extracted' folder ...
5
votes
3answers
449 views

Changing a windows name by patching create window function call

I use x64dbg and IDA Pro the process is 32bit. I'm not sure if I'm doing this right or not because I'm getting a crash which I'm not sure if it's caused by me doing something wrong or the startup ...
1
vote
0answers
180 views

Stack buffer overflow SIGSEGV help

I've been going at this for a couple of days now working through trial and error but I can't seem to pinpoint exactly why I'm still getting a SIGSEGV. Here's the stdout of me stepping through the ...
1
vote
1answer
3k views

Import table vs Import Address Table

What's the difference between the Import Table and the Import Address Table?
4
votes
1answer
953 views

Reverse Engineering Windows PowerBuilder Binaries

I recently stumbled across a binary file built using Sybase PowerBuilder 12.5 and I am looking for any assistance in reversing it as it's actually quite different than a typical C++ binary. I'm ...
-1
votes
1answer
284 views

Shells CTF segfault - wrong address

PicoCTF 2017 Shells I have a binary and source: #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <sys/mman.h> #define AMOUNT_OF_STUFF 10 //TODO: Ask IT ...
0
votes
1answer
925 views

Unpacking firmware

I have a ROM dump firmware which must be reversed (as a task). Binwalk output: DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------------------------------------...
-3
votes
1answer
317 views

what does VA and OEP means? and How does IAT be fixed manually? [closed]

in the context of reversing a packed binary, what does VA and OEP means? and How can IAT be fixed manually?
0
votes
1answer
310 views

Unpacking ROM dump

I have a ROM dump from an unknown controller, which must be reversed (as a task). It looks like encrypted, packed or obfuscated. Binwalk did not give any information("cisco os experimental microcode ...
1
vote
0answers
502 views

My core dump's backtrace stops to a signal handler, what can I do?

I obtained an ELF core dump that was provoked by fuzzing a proprietary server. As I do not have access anymore to the machine that hosted this server, and the server is part of a tightly coupled set ...
1
vote
1answer
769 views

How can I convert a .bin file to either assembly or C?

I have a .bin file (It's a firmware belongs to a hardware (Cisco Access-Point) ). All I need to do is modifying that .bin file. As you know, .bin files aren't human readable. I need to convert it to ...
2
votes
2answers
194 views

Track execution of bytes in a Linux executable

Given a binary executable file (in this case, a compiled C file which finds the gcd of 2 numbers), is there a tool which profiles the execution of this file and could generate some sort of call graph ...
1
vote
1answer
107 views

possible to get reference assembly address in file for special memory address?

Hello I try to learn reverse engineering, so i use from process hacker to view dynamic strings in the process's memory... (more info) i get something like this : Address Length Result --------------...
0
votes
1answer
78 views

Gaps between sections

After analyzing some binaries, I noticed that the sections, .text, .data, .bss, etc, are not really adjacent. It seems to be a gap between them, why is that?
0
votes
1answer
146 views

How can I tell if a virus was made by Russians? [closed]

I have been looking around quite a bit on the internet for something that could tell me more than basic section on a binary. I have a PE file and usually I see just what compiled it (MSVS or GCC ... ...
2
votes
1answer
380 views

File analysis with hexdump - unknown container

I have a backup file, generated by an android phone. However, I don't know the file type or how to extract the contents without the original software. I've tried to search for common file headers ...
5
votes
1answer
724 views

OLLYdbg is stopping on 7000000 addresses on the ntdll and not the entry point of the application

i am solving the leena's 4th binary challenge.but the ollydbg is unable to stop at Entry point which some around 400000 or above.Application stops working and start with some around 700000 check the ...
1
vote
1answer
1k views

reversing stripped & statically linked binary with radare2

As the question says I need to reverse a stripped elf binary with radare2. This binary is also statically linked. I already reversed it in IDA by identifying statically linked libraries using lscan ...
0
votes
2answers
760 views

binwalk on reversing switch firmware

everyone. I am a green apple in reversing. Recently i wanna reverse a switch but get some problems. i reaaaaaaaaly need your guys help. first i extract the .bin file from the switch and use binwalk ...
3
votes
3answers
3k views

Home router's firmware reverse engineering

I was searching through my routers admin page some time ago and I've noticed that it doesn't support firmware updates by the user(it's an ISP's speedport entry 2i router(zte variant)). So long story ...
0
votes
1answer
136 views

Finding variable reference in cpp

Let's bring example We have string 0000000000bd2906 db "CurrentKey", 0 ; DATA XREF=sub_555670+3390 And it's used here 00000000005563ae lea rsi, qword [0xbd2906] ; "CurrentKey" Disassembler ...
1
vote
1answer
1k views

Disassembling MIPS 32 version 1 binary with the Radare2 Framework

I am trying to disassemble a MIPS 32 version 1 binary with the Radare2 framework. Here is the full output of the file command: ELF 32-bit LSB executable, MIPS, MIPS32 version 1 (SYSV), dynamically ...
6
votes
1answer
2k views

How to make radare2 work for a large binary?

I compiled cpython with debugging headers and I want to perform the following analysis using radare2. The problem I encounter is that it takes forever (at least 27 hours) to perform the aaa (...
12
votes
3answers
5k views

How to generate the call graph of a binary file?

I have a non-stripped ELF binary for which I want to create a call graph as a dot file. Is there such a tool which generates the call graph? EDIT: Is there away in addition to the conventional call ...
1
vote
2answers
166 views

How to monitor specific variables in a running process?

I would like to monitor, record, specific variables in an application but I am not sure what is the right way to approach this problem. The application is a mix of C(5%) and C++(95%) and it is ...
0
votes
1answer
136 views

Can anyone help me identify and decode this string? [closed]

Below is a part of a code that I reversed with repy2exe and I want to understand what it does and especially how to decode the value in the "secret" variable: using = [ 'Mg==\n', 'MTA1\n', ...
0
votes
1answer
435 views

Need help with binary file analysis

So I'm currently trying to analyze a resource archive file of an old game. What I got so far The file is supposed to represent a "virtual drive", the format is called VDRV. This means there are ...
1
vote
1answer
1k views

Decoding binary data structure

I have these data files that are generated by a tool which was distributed by a company that is long defunct. I have been taking it apart with a binary file viewer (freeware from Proxoft, it is a ...
1
vote
1answer
187 views

How can I debug this binary (which I suspect does encryption)?

I have a snippet of binary code which performs some encryption algorithm (most likely modified RC4). I have four variables associated with the encryption (seed_key_arg [1-3] and a seed_key) and ...
1
vote
1answer
525 views

Could not find ld-linux-x86-64.so.2 in strace output

I did a ldd on /bin/cat and I see that dynamic loader library /lib64/ld-linux-x86-64.so.2 is a part of it. ldd /bin/cat linux-vdso.so.1 (0x00007ffe743f4000) libc.so.6 => /lib64/libc.so.6 (...
0
votes
1answer
63 views

How to find out where an application stores the resolutions it allows?

Many applications (in particular most games) offer a set of resolutions to choose from. Some of them are pretty open and allow basically every resolution the underlying system seems to be capable of, ...
1
vote
1answer
3k views

Need help extracting JFFS2 filesystem from .img firmware binary

I'm trying to access the filesystem of the EA2750's firmware. Here is a link to download it http://downloads.linksys.com/downloads/firmware/FW_EA2750_1.1.7.172380_prod.img. The problem is it is an img ...
1
vote
0answers
224 views

Accessing .rodata/.rel.data.ro

Analyzing an android ELF binary. How/where does something access a specific area of .rodata or .rel.data.ro? Have tried using objdump, rabin2, readelf, etc and I can't seem to figure out how it is ...
-1
votes
1answer
257 views

Disassembling code with Hopper

I'm trying to figure out what this code is doing. The first thing that I don't understand is the condition that tests if arg0's value is 0x2. I read that 0x2 in ASCII is STX (Start of text). Here's ...
1
vote
1answer
637 views

How to convert the dumped firmware (from linksys-wrt54gl via JTAG port) in an understandable format

Issuing some commands for the dumped firmware: $ du -h fw.bin 4.0 M $ file fw.bin fw.bin: data $ file -i fw.bin fw.bin: application/octet-stream; charset=binary $ binwalk fw.bin - $ enca -L none ...
1
vote
2answers
828 views

newbie trying to understand disassembled code

I have been writing small C programs and then disassembling them to try to understand what is actually happening under the hood. I am using mingw-w64 on Windows 7 for my work, and I have run into a ...
3
votes
1answer
281 views

How can the problem posed for disassembly by the admixture of executable code and literal pools in ARM firmware be overcome?

It's probably too soon for me to ask about this since I'm not familiar with ARM but it's been bothering me for a while now so I'm going to ask anyway. Context and Background Information Part 1: ARM ...
6
votes
3answers
2k views

Running a binary identified as an ARM excutable by binwalk --disasm

I have a Philips 10FF2 picture frame I'm trying to reverse engineer. In the firmware download from the Philips website (http://download.p4c.philips.com/files/1/10ff2cme_00/10ff2cme_00_fus_aen.zip) I ...
2
votes
1answer
177 views

Trying to reverse engineer teamviewer's printer driver

Unlike LogMeIn or GoToMyPC, TeamViewer does not have any driver files except for the INF and GPD files. LogMeIn and GoToMyPC have their own configuration and driver dlls, while TeamViewer uses the ...
1
vote
1answer
716 views

Trying to identify a string in a strcmp instruction

Working to debug and analyze a piece of firmware, I've come across a bunch of cgi files which are all symlinked to a central cgi file. The first thing the main function does is run a series of string ...
1
vote
1answer
3k views

Reverse engineering binary file to find flag

The binary is from here: https://files.fm/u/qtqmhhdd I've been attempting this a couple of days. Its an ELF-64 bit file and I've gdb and IDA to see how it works for a while. You can run the file by ....
4
votes
2answers
194 views

Problem with converting hex values to decimal

I'm reverse-engineering custom binary file format. I'm using 010 Editor to check this file. I found data structure to represent UTF-8 strings, which has header section of one or two bytes in length ...
2
votes
1answer
752 views

how to overcome setunhandledexceptionfilter in ollyDebugger?

I am debugging a malware sample which is using setunhandledexceptionfilter() for anti-debugging. I don't know how to handle this. Can you guys please explain the setunhandledexceptionfilter() anti-...
3
votes
1answer
2k views

How to get the disassembly line without offset translations in IDAPython?

When I use GetDisasm()to get disassembly line, I find out that it will show some memory references as a variable name. For example, when raw assembly is: mov %r15, 0x20b062(%rip)` GetDisasm()'s ...
0
votes
1answer
82 views

Finding What Data Means From File?

I have a file with the extension of "TOC" I assumed it meant Table of Contents, and the contents of said file represent that it indeed is one. It's full of content such as this: 117dbdd0 15 ...
12
votes
1answer
11k views

Approach to extract useful information from binary file

The purpose of this question is to gain an understanding of the concepts behind reverse engineering and to understand what approaches may be taken to extract useful information from a binary file. I'...
7
votes
3answers
4k views

Extracting a NAND flash dump with OOB data

I'm trying to extract a NAND flash dump of an old Walkman player. The dump was done by a friend and unfortunately cannot be redone because the chip was destroyed. The dump was supposed to be just user ...
2
votes
2answers
392 views

Need help unraveling the format (time, string, float/decimal, integer/float/decimal) in .dat file

The files (idx, dat) are from a plant/facility operational historian. The .dat file is supposed to have entries, each with identifier (tag name/id/key), value (decimal/float) for different times (...
1
vote
1answer
379 views

How can I change the values in esp?

0x08048785 <+344>: movl $0x0,0xc(%esp) 0x0804878d <+352>: movl $0x804896c,0x8(%esp) 0x08048795 <+360>: movl $0x8048973,0x4(%esp) 0x0804879d <+368>: movl ...