Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [binary-analysis]

The process of gathering information about a binary file, either with static or dynamic methods.

-1
votes
1answer
1k views

How to extract D-Link DCS-4603 camera firmware

I tried extract the firmware image from the binary file available at the D-Link DCS-4603 Vigilance Full HD PoE Dome Network Camera technical support page it by using binwalk but failed. Is there ...
2
votes
1answer
2k views

Are there any static binary rewriting tools?

My goal is to modify some instructions and make some instrumentation in ELF executables or libraries(For example, modifying all memory writes instructions). Since there're so many instructions, I want ...
4
votes
2answers
2k views

How to SUCCESSFULLY add a code section to an executable file in Linux?

I am in Linux, and I have seen this question a few times but never, nobody answered how to really make this work. I need to add a section to an already compiled binary. Lets say for a moment is an ...
3
votes
1answer
255 views

How to adjust function type/call parameters to custom structs in IDA Pro?

I'm trying to reverse-engineer a function in IDA Pro that was originally identified by IDA as such (I was able to rename it into Device_CreateCloseIoControl): but I know that this function was ...
2
votes
2answers
5k views

Reverse Engineering a Firmware. Someone can help me?

I am currently trying to reverse-engineer a firmware file to learn the topic but I am a little bit stuck. I tried to use binwalk to get more information about the file but this did not produce ...
0
votes
2answers
135 views

Antidebug/reverse engineering targeted for libraries [closed]

So I'm reading about antidebug and anti-reverse engineering techniques, but these cover, in all the docs I've seen, just executables. Are there any resources that target specifically shared and ...
3
votes
0answers
599 views

Reverse-engineering DOS game's data files

I would like to figure out the data format used by an old DOS game I used to play when I was a kid. That link includes a full download for all the files and it runs fine in DOSBox if you want to try ...
0
votes
1answer
173 views

How do I Reverse Firmwares? [closed]

How do I Reverse Firmware? What is firmware binary?
0
votes
1answer
1k views

.bin files Firmware

I'm looking for help in analyzing a few .bin files. I have a program that installs a "firmware" update when I connect my camera through USB. I'm on a Mac Os Sierra. Inside the Applications Folder ...
4
votes
2answers
849 views

Difference between objdump -r and -R switches

objdump man page says, -r --reloc Print the relocation entries of the file. If used with -d or -D, the relocations are printed interspersed with the disassembly. -R --dynamic-reloc ...
0
votes
2answers
744 views

Memory dump analysis

I'm trying to learn firmware analysis. The device I chosen was my Motorola SBG901 modem. I managed to dump the memory contents via JTAG using the FlashcatUSB adapter. The memory dump is about 8MB in ...
0
votes
1answer
624 views

Binwalk and myisamchk Yi Dome Cam firmware

I am trying to get to the root file system of a Yi Dome Camera and I haven't done this before. Can anyone point me in the right direction? I ran binwalk on the firmware which showed: DECIMAL ...
0
votes
1answer
1k views

Automatically extract known file types (eg. zip) using binwalk

This should have been made easy using binwalk however I fail to understand what I did wrong with the following syntax: $ wget --content-disposition https://github.com/devttys0/binwalk/archive/v2.1.1....
0
votes
1answer
466 views

Daikin A/C 4bit CRC/Checksum

I am reverse engineering IR protocol of Daikin A/C. AC sends the whole current state of remote on each key press. Data sent is 8 byte long, last 4 bits seem to be the some kind of error checking. ...
0
votes
1answer
7k views

extracting data from binary file

I have a binary file and a text file of the corresponding data, and I know the location in the binary file where the data are contained. However, I am unable to determine in what manner the data are ...
1
vote
0answers
204 views

Analyzing Game Map/Terrain Format

I'm trying to understand how this game builds the map and terrain. Specially if it uses a heightmap. So I can write an app that can view the map and move around (camera) freely. First, I'm not ...
3
votes
1answer
85 views

How would one find test cases for a self-implemented value set analysis (VSA)?

I read a blog post about value set analysis (VSA). For VSA, see e.g. here. The blog author writes I’ve been trying to get to the point where the example in Balakrishnan’s dissertation works. I ...
0
votes
1answer
94 views

how Can I use a linux so file from a program other than the program it was developed for?

I wish to use the codecs that come with realplayer but without needing realplayer. The codecs I want to use are all in .so format, but I don't know how to separate the codecs from the rest of ...
1
vote
0answers
460 views

How can I find loading adress of eCos image

Hey guys Im trying to find loading address (entry point of my program) for this binary, which is part off this firmware. Im trying to load it inside of IDA, how can I correctly load it, how to find ...
5
votes
1answer
4k views

Remove code signature from a Mac binary

How can I remove the code signature from a binary so that I can patch it without the binary refusing to run afterwards? Needless to say, I'm not the original creator of the binary, nor I have the ...
1
vote
1answer
1k views

Simple carving of zip file using binwalk

I have been trying to use binwalk on a very large dump file without much success so far. Everytime I tried to use it, it produces very large zip file that fill the disk until I reach a disk full error ...
0
votes
2answers
205 views

Static Linking as an anti-RE method?

A lot of reverse engineering tutorials I've seen involve using the import address table to determine what functions a program calls based on which libraries it imports. But doesn't static linking a ...
1
vote
2answers
468 views

binwalk cannot find gzip sections

I am starring at the following exe file, see main page here. It seems pretty clear (using -E entropy option) that the exe contains compressed section. For some reason binwalk is not capable of finding ...
1
vote
2answers
511 views

Is it possible copy and save bootloader using CLI telnet commands?

I need get copy of original Bootloader from device running embedded Linux. Is it possible copy and save bootloader using CLI telnet commands? I have full access to CLI interface. Is there way copy ...
1
vote
0answers
96 views

Record-replay tools for Windows?

Are there any user-mode record-replay tools for Windows that can capture native execution of a program so that it can be replayed deterministically later? Instructions, memory accesses, syscalls and ...
1
vote
2answers
445 views

What is the difference between program slicing and taint analysis?

I'm studying program slicing and taint analysis. I know notion of program slicing and taint analysis. I think Program slicing and taint analysis are similar notion. I don' know difference between ...
8
votes
3answers
2k views

Control flow graph reconstruction projects

I'm looking for projects providing reconstructed Control Flow Graphs from binaries while supporting more than one platform (e.g. x86, x64, arm). For example, considering this short assembler program: ...
0
votes
1answer
5k views

Extract firmware of my camera (Lumix MG5)

I bought a Camera (Lumix GM5), but I can't change the language of it. The easy way is to send it back to Amazon, but I want to try to change it by modifying the firmware before. So, I used binwalk ...
0
votes
2answers
2k views

Recognize the library functions of statically linked executable file in IDA Pro

Recently I worked on a Linux program which has all of its symbols stripped. Opening it with IDA resulted in none of its functions identified. Thus I tried to extract any usable information from the ...
7
votes
1answer
2k views

Zte Reverse engineering config.bin file problem

I just got a Zte ZXHN F660 GPON ONT Wireless router with my optic fiber internet provided by my telecom provider. My first discovery was that the eth Lan ports are bricked wich means I can only use ...
0
votes
1answer
486 views

Fixing weird no-sections embedded ELF binary for decompilation

I recently stumbled upon a weird binary, complied by a "Qualcomm Hexagon" compiler. The ELF binary seems fine, however section tables (section header size and string table index) seem empty. For those ...
4
votes
1answer
1k views

Reversing a 3D file format from 2001

This is a korean MMORPG released back in 2001. The game and the company no longer exists. I've been analyzing the file formats as a personal project for awhile now. I have already decoded the ...
0
votes
1answer
96 views

Order of architecture headers in fat (universal) executables

I'm working on a reverse engineering project with fat executables on OS X. So far I have established the structure of the fat_header, fat_arch and macho_header, but am having trouble finding ...
2
votes
1answer
1k views

Firmware-mod-kit says “No supported filesystem” along with strange and long output

I tried firmware-mod-kit's extract-firmware.sh script and I receive the following output which ends with "No supported filesystem found". The firmware belongs to the TL-WR740Nv5 router. The ...
15
votes
1answer
2k views

Decoding an unknown image format with “DREK” signature (*.drk)

There are some unknow images, which I would like to decode to RRGGBBAA format. It was a really hard work, but at the moment I can somewhat understand, that which part of the binary is responsible for ...
0
votes
1answer
2k views

Finding password in disassembled code

I'm trying to learn reverse engineering techniques, apologies in advance if I leave anything out I'm trying to find the password in the following section of disassembled code (there are other blocks ...
1
vote
1answer
657 views

Function dependencies in static libraries

I read in another SO thread: With static libraries, the unit of copying is the object file in the library. In other words, if two programs call a function from a certain object file, both ...
0
votes
1answer
139 views

Unknown algorithm in forloop

i am reversing a malware sample .but getting stucked in a loop below.the line written in the bold letter generated random letter like "/2","/lm32" etc to EDX.The thing is that ECX does not contains ...
1
vote
0answers
746 views

Modification of existing binary firmware update

I have several IP cameras from china, and I need to add some software to it. I have to ways how to burn my software into camera ROM using hardware programmer and using special binary what I upload ...
0
votes
1answer
497 views

Reverse engineering a disassembled C binary

I have a disassembled C binary that I would like to reverse engineer. It is a program that takes an input "username" string, and returns a (most-likely) unique 8-digit hex number for identification ...
1
vote
2answers
145 views

Figure out whether a function has return value of not?

I am doing binary analysis on x86-64bit ELF binaries. All the binaries are compiled from C language. Basically, for a given function, I would like to figure out whether this function has a return ...
3
votes
2answers
2k views

Intel Pin memory operations tracking

I am using Intel Pin in order trace memory activity of an executable on Windows. What I have found, that most of the memory operands (Read or Write) operates with 2 or 4 bytes. So I decided to modify ...
3
votes
3answers
213 views

Dynamic instrumentation tools which support reverse execution

I am trying to analyze some execution crash information, and to better identify the root cause of memory access error, I would like to reverse execute the program from the crash point. For example, ...
8
votes
1answer
280 views

Byte frequencies in different architectures' binaries?

what I'm looking for I have a binary that, for various reasons, I'm pretty sure is executable machine code (although possibly for a VM language, although I doubt it's Java). I'm looking for a table ...
2
votes
2answers
296 views

Dynamic analysis of malware samples

I have thousands of Linux malware samples in ELF format. And I am thinking to use dynamic analysis (say, PIN) to obtain an execution trace of each malware sample. However, I am afraid such activity ...
7
votes
4answers
2k views

What is the “standard” approach to find loop in binary code?

I am working on some x86 (32/64 bits) ELF binary code. These binaries are compiled from C and C++ program code and I am trying to detect loops inside the binaries. I am newbie to this area, and I am ...
0
votes
1answer
4k views

binwalk zlib data [closed]

I'm reversing firmware and I get some problem with it. I used binwalk to reversing the firmware, but binwalk produced different result than to my friend. My friend found some zlib data (see 1), but I ...
0
votes
1answer
213 views

How would you protect this Crypter?

Imagine you are working in a kind of crypter that only works with the current function deciphered, rest of the code is ciphered by symmetric encryption. When a new function is about to be called, the ...
2
votes
1answer
583 views

Given a program binary, how can I know which compiler it is compiled from?

Basically I have a set of 32-bit ELF program binaries compiled by either gcc or llvm. They are all stripped before analysis. My question is that, given a binary, is there any way I can determine ...
5
votes
2answers
840 views

Reverse engineer 4-bit checksum (?) in Sanyo air conditioning IR packet

I am reverse engineering IR protocol of Sanyo air conditioner. AC sends the whole current state of remote on each key press. Data sent is 67 bits long, last 4 bits seem to be the some kind of error ...