Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [binary-analysis]

The process of gathering information about a binary file, either with static or dynamic methods.

1
vote
0answers
194 views

Analyzing Game Map/Terrain Format

I'm trying to understand how this game builds the map and terrain. Specially if it uses a heightmap. So I can write an app that can view the map and move around (camera) freely. First, I'm not ...
3
votes
1answer
85 views

How would one find test cases for a self-implemented value set analysis (VSA)?

I read a blog post about value set analysis (VSA). For VSA, see e.g. here. The blog author writes I’ve been trying to get to the point where the example in Balakrishnan’s dissertation works. I ...
0
votes
1answer
93 views

how Can I use a linux so file from a program other than the program it was developed for?

I wish to use the codecs that come with realplayer but without needing realplayer. The codecs I want to use are all in .so format, but I don't know how to separate the codecs from the rest of ...
1
vote
0answers
443 views

How can I find loading adress of eCos image

Hey guys Im trying to find loading address (entry point of my program) for this binary, which is part off this firmware. Im trying to load it inside of IDA, how can I correctly load it, how to find ...
3
votes
1answer
4k views

Remove code signature from a Mac binary

How can I remove the code signature from a binary so that I can patch it without the binary refusing to run afterwards? Needless to say, I'm not the original creator of the binary, nor I have the ...
1
vote
1answer
1k views

Simple carving of zip file using binwalk

I have been trying to use binwalk on a very large dump file without much success so far. Everytime I tried to use it, it produces very large zip file that fill the disk until I reach a disk full error ...
0
votes
2answers
186 views

Static Linking as an anti-RE method?

A lot of reverse engineering tutorials I've seen involve using the import address table to determine what functions a program calls based on which libraries it imports. But doesn't static linking a ...
1
vote
2answers
420 views

binwalk cannot find gzip sections

I am starring at the following exe file, see main page here. It seems pretty clear (using -E entropy option) that the exe contains compressed section. For some reason binwalk is not capable of finding ...
1
vote
2answers
490 views

Is it possible copy and save bootloader using CLI telnet commands?

I need get copy of original Bootloader from device running embedded Linux. Is it possible copy and save bootloader using CLI telnet commands? I have full access to CLI interface. Is there way copy ...
1
vote
0answers
94 views

Record-replay tools for Windows?

Are there any user-mode record-replay tools for Windows that can capture native execution of a program so that it can be replayed deterministically later? Instructions, memory accesses, syscalls and ...
1
vote
2answers
408 views

What is the difference between program slicing and taint analysis?

I'm studying program slicing and taint analysis. I know notion of program slicing and taint analysis. I think Program slicing and taint analysis are similar notion. I don' know difference between ...
8
votes
3answers
2k views

Control flow graph reconstruction projects

I'm looking for projects providing reconstructed Control Flow Graphs from binaries while supporting more than one platform (e.g. x86, x64, arm). For example, considering this short assembler program: ...
0
votes
1answer
5k views

Extract firmware of my camera (Lumix MG5)

I bought a Camera (Lumix GM5), but I can't change the language of it. The easy way is to send it back to Amazon, but I want to try to change it by modifying the firmware before. So, I used binwalk ...
0
votes
2answers
1k views

Recognize the library functions of statically linked executable file in IDA Pro

Recently I worked on a Linux program which has all of its symbols stripped. Opening it with IDA resulted in none of its functions identified. Thus I tried to extract any usable information from the ...
6
votes
1answer
2k views

Zte Reverse engineering config.bin file problem

I just got a Zte ZXHN F660 GPON ONT Wireless router with my optic fiber internet provided by my telecom provider. My first discovery was that the eth Lan ports are bricked wich means I can only use ...
0
votes
1answer
448 views

Fixing weird no-sections embedded ELF binary for decompilation

I recently stumbled upon a weird binary, complied by a "Qualcomm Hexagon" compiler. The ELF binary seems fine, however section tables (section header size and string table index) seem empty. For those ...
3
votes
1answer
948 views

Reversing a 3D file format from 2001

This is a korean MMORPG released back in 2001. The game and the company no longer exists. I've been analyzing the file formats as a personal project for awhile now. I have already decoded the ...
0
votes
1answer
94 views

Order of architecture headers in fat (universal) executables

I'm working on a reverse engineering project with fat executables on OS X. So far I have established the structure of the fat_header, fat_arch and macho_header, but am having trouble finding ...
2
votes
1answer
995 views

Firmware-mod-kit says “No supported filesystem” along with strange and long output

I tried firmware-mod-kit's extract-firmware.sh script and I receive the following output which ends with "No supported filesystem found". The firmware belongs to the TL-WR740Nv5 router. The ...
15
votes
1answer
2k views

Decoding an unknown image format with “DREK” signature (*.drk)

There are some unknow images, which I would like to decode to RRGGBBAA format. It was a really hard work, but at the moment I can somewhat understand, that which part of the binary is responsible for ...
0
votes
1answer
2k views

Finding password in disassembled code

I'm trying to learn reverse engineering techniques, apologies in advance if I leave anything out I'm trying to find the password in the following section of disassembled code (there are other blocks ...
0
votes
0answers
273 views

How to get the arguments passed to a function located in a DLL?

I am using Pydbg for resolving the exported function address located in the dll. Going through the pydbg documentation, i couldn't find a way to dump the arguments passed to those functions.
-1
votes
0answers
111 views

NSArray arrayWIthObjects: count: , where the objects are in 128-bit registers

Given the following assembly code on a 64-bit machine: movq xmm1, CFString_ptr; // moves the CFString_ptr to the low quadword of xmm1 and zeros the high quadword of xmm1 If, in objective-c, this 128-...
1
vote
1answer
617 views

Function dependencies in static libraries

I read in another SO thread: With static libraries, the unit of copying is the object file in the library. In other words, if two programs call a function from a certain object file, both ...
0
votes
1answer
138 views

Unknown algorithm in forloop

i am reversing a malware sample .but getting stucked in a loop below.the line written in the bold letter generated random letter like "/2","/lm32" etc to EDX.The thing is that ECX does not contains ...
1
vote
0answers
698 views

Modification of existing binary firmware update

I have several IP cameras from china, and I need to add some software to it. I have to ways how to burn my software into camera ROM using hardware programmer and using special binary what I upload ...
0
votes
1answer
482 views

Reverse engineering a disassembled C binary

I have a disassembled C binary that I would like to reverse engineer. It is a program that takes an input "username" string, and returns a (most-likely) unique 8-digit hex number for identification ...
1
vote
2answers
145 views

Figure out whether a function has return value of not?

I am doing binary analysis on x86-64bit ELF binaries. All the binaries are compiled from C language. Basically, for a given function, I would like to figure out whether this function has a return ...
2
votes
2answers
1k views

Intel Pin memory operations tracking

I am using Intel Pin in order trace memory activity of an executable on Windows. What I have found, that most of the memory operands (Read or Write) operates with 2 or 4 bytes. So I decided to modify ...
3
votes
3answers
210 views

Dynamic instrumentation tools which support reverse execution

I am trying to analyze some execution crash information, and to better identify the root cause of memory access error, I would like to reverse execute the program from the crash point. For example, ...
8
votes
1answer
276 views

Byte frequencies in different architectures' binaries?

what I'm looking for I have a binary that, for various reasons, I'm pretty sure is executable machine code (although possibly for a VM language, although I doubt it's Java). I'm looking for a table ...
2
votes
2answers
281 views

Dynamic analysis of malware samples

I have thousands of Linux malware samples in ELF format. And I am thinking to use dynamic analysis (say, PIN) to obtain an execution trace of each malware sample. However, I am afraid such activity ...
7
votes
4answers
1k views

What is the “standard” approach to find loop in binary code?

I am working on some x86 (32/64 bits) ELF binary code. These binaries are compiled from C and C++ program code and I am trying to detect loops inside the binaries. I am newbie to this area, and I am ...
0
votes
0answers
74 views

Automatically tagging an executable

I am wondering if there is any tool that can do this job: Given an utility executable (for example, binaries from GNU Coreutils), this system can automatically tag it, say, assigning an "encoding", "...
0
votes
1answer
3k views

binwalk zlib data [closed]

I'm reversing firmware and I get some problem with it. I used binwalk to reversing the firmware, but binwalk produced different result than to my friend. My friend found some zlib data (see 1), but I ...
0
votes
1answer
209 views

How would you protect this Crypter?

Imagine you are working in a kind of crypter that only works with the current function deciphered, rest of the code is ciphered by symmetric encryption. When a new function is about to be called, the ...
2
votes
1answer
545 views

Given a program binary, how can I know which compiler it is compiled from?

Basically I have a set of 32-bit ELF program binaries compiled by either gcc or llvm. They are all stripped before analysis. My question is that, given a binary, is there any way I can determine ...
5
votes
2answers
790 views

Reverse engineer 4-bit checksum (?) in Sanyo air conditioning IR packet

I am reverse engineering IR protocol of Sanyo air conditioner. AC sends the whole current state of remote on each key press. Data sent is 67 bits long, last 4 bits seem to be the some kind of error ...
6
votes
1answer
2k views

Unpack IpCam firmware - Binwalk extraction issue

I'm trying to use Binwalk to extract an IpCam bin firmware. I did it successfully for the WebUI, but I can't on the firmware itself. Hardware : Vstarcam C7824WIP Firmware : CH-sys-48.53.64.67.zip ...
5
votes
1answer
328 views

Challenging variable-length integer encoding

I have a piece of binary data I'm trying to investigate. My guess is that it should be part of simple filesystem-like index. There are 2 parts in the file. First part has a very simple format: number ...
6
votes
1answer
415 views

Difference between Win7 and Win8 PE loader?

Is it known what the differences between the Window 7 and Windows 8 PE loader are? I'm trying to hand-craft a simple executable PE image file. It runs well in Windows 7, but is rejected by Windows 8....
3
votes
0answers
560 views

Reverse engineer TPMS sensor data

I'm trying to reverse engineer data received from TPMS (car tire pressure) sensors. I was able to receive and demodulate the data (433 MHz, FSK, Manchester encoding). Probable packet fields: ...
2
votes
1answer
496 views

Analyzing a Login Process

I am reverse engineering a program that uses a custom auth protocol. This is a basic outline of the process: Client takes input for username and password, then sends username to the auth server. Auth ...
0
votes
1answer
2k views

Decode 96 column punch card

I don't know if this is the right place to ask, but I can't seem to find it anywhere on the internet: How do I read a 96 column IBM system/3 punch card? I am doing an exercise but I can't seem to ...
3
votes
0answers
756 views

Analysing eCos image

I'm working on unpacking a firmware image. I've already uncompressed the original image, but I'm stuck in the current step. This is the current uncompressed image: https://www.dropbox.com/s/...
7
votes
1answer
1k views

Reverse engineering Earthsiege 2 3D model format

As a personal project I've been trying to reverse engineer the art assets for the old Dynamix game Earthsiege 2 (this game has long been abandonware and was recently released for free by Hi-Rez, the ...
-1
votes
0answers
89 views

Garbage value after Stack frame allocation?

Can anyone explain me why do these garbage values present on stack? Below is the disassembly view of the binary. Let me know in case you need the corresponding C source code. So basically I'm not ...
5
votes
1answer
364 views

How to read these UV coordinates?

I'm trying to reverse engineer 3D models (cars) from a racing game from 1997 (Test Drive 4). I'm able to extract the 3D mesh and textures, but cannot figure out how UV mapping works yet. There is ...
0
votes
2answers
1k views

Obtaining memory locations of local variables

For ELF binaries on Linux, if the executable is not stripped, it is possible to recover memory locations of location variables in the form of relative addresses to stack/frame pointer? As an example, ...
2
votes
0answers
505 views

Reverse engineering TPMS sensor data [closed]

I'm trying to reverse engineer data received from TPMS (car tyre pressure) sensors. I used rtl_433 tool to capture the data from sensor at 433 MHz. Tool was able to detect data is using FSK modulation ...