Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [binary-analysis]

The process of gathering information about a binary file, either with static or dynamic methods.

1
vote
2answers
306 views

How hard is it to interpret binary data of a new and unknown format, if it's unknown what data is encoded?

This question is based off of my answer to a world building question: https://worldbuilding.stackexchange.com/questions/30471/how-could-a-blind-alien-race-interpret-video-broadcast-into-space/30497?...
0
votes
0answers
102 views

Locate compressed section of executable

I am playing with Philips DICOM Viewer - download version R3.0 SP3. This viewer can display DICOM information (press F9). Since the displayed strings are not stored in the DICOM file itself, I suspect ...
0
votes
1answer
53 views

Callee's return precalculations

Good day. I build this simple code on Intel cpu working on Windows 7 with MS VS Express 2013: #include <stdio.h> int f(int a, int b, int c); int f(int a, int b, int c){ int d = a*b + c; ...
1
vote
1answer
276 views

Variable liveness analysis on binaries

I want to detect all the variables live at any instruction/address in a binary. By variable, I refer to both global as well as function local variables. In other words, given a Linux ELF and a virtual ...
2
votes
0answers
74 views

How can I further identify a file which the file command lists as 'data' [closed]

I have file named 'out'. If I issue the file command I see : :~/Desktop# file out out: data How can I further identify what type of file this is? Interestingly, if I execute the file, I see a '...
4
votes
2answers
383 views

Locating Memory Allocation Functions from Static Analysis

I'm currently working on reversing a firmware binary for an embedded device. This device is using an uncommon architecture: it is a modified Harvard architecture, running on a TMS320C55x chipset with ...
0
votes
2answers
178 views

How to identify the structure of this specific data file? [closed]

What is the structure of this database file from an old videogame? https://www.dropbox.com/s/ioe26pi3y1w3320/TMDATA1.S8?dl=0 Apologies in advance because fixing specific problems is not really the ...
1
vote
1answer
401 views

Binary Instrumentation of malware binaries?

I am developing a dynamic instrumentation tool using Intel PIN to analyze malware binaries in windows. From what I have learned so far is that I am able to use the tool with programs I write using C/C+...
2
votes
0answers
635 views

IDA Pro user-defined offsets (again)

I'm disassembling a simple Z80 program and can't for the life of me work out how to - successfully - specify a user-defined offset. I have a line of code as: ld de, #0x6058 and FTR, this address ...
2
votes
1answer
744 views

How to reverse engineer a database file format?

It is an accounting database whose database file format is proprietary data. But the problem is the database is highly unreliable, corruption go unnoticed for years after which it becomes unbearably ...
4
votes
3answers
905 views

Automatically decode PUSH+RET call into JMP

While reversing a piece of malware I've faced with anti-disasm trick, that actually is well described here. So my question is: would the assembly patching of whole the PUSH+RET stubs to JMP(i.e. C3-> ...
0
votes
1answer
139 views

Does anybody know which tools allow to get (pseudo) code from a Moscow ML executable?

I've decompiled Win32 executable that is the result of compilation of a program written in Moscow ML language. The resulting listing contains standard C main function that contains the call to ...
1
vote
1answer
349 views

Specific byte purpose in header of little endian ARM binary

I have a little endian 32-bit ARM binary, compiled for a CPU that's running embedded Linux. I want to figure out what a specific byte in the binary means. An example hex view of the first few bytes of ...
3
votes
2answers
276 views

One-pass streaming algorithm for detecting bytecode/opcode?

I am searching for an algorithm and/or snippet of code that provides a one-pass algorithm over a steady datastream that can detect a valid sequence of bytecode or opcode. There are no PE32, ELF, or ...
3
votes
1answer
940 views

Reverse engineer 4-bit CRC in LG IR packet

I am reverse engineering IR protocol of LG air conditioner. AC generally send the whole current state of remote on each key press. Data sent is 28 bits long, last 4 bits seem to be the checksum. I ...
0
votes
0answers
289 views

Intercepting syscall in a shared object (dynamically linked)

Ditto. Any technique that allows to intercept sys calls issued from a shared object file? At runtime, the shared object is dlopen'ed by main(). One candidate is to use static binary rewriting (e.g. ...
1
vote
3answers
496 views

Dump global datas to disk in assembly code

the experiment is on Linux, x86 32-bit. So suppose in my assembly program, I need to periodically (for instance every time after executing 100000 basic blocks) dump an array in .bss section from ...
4
votes
4answers
935 views

Why are PUSHF and POPF so slow?

the experiment is on 32-bit x86 Linux. I am doing some static binary instrumentation work, and basically I am trying to insert some instructions below to the beginning of every basic block. BB23 : ...
2
votes
1answer
125 views

Tracing variable access/usage instructions

There is a great little closed-source freeware Windows program (written in Delphi) that I have been using for years. WinBar shows a little bar above the TaskBar which gives some system information and ...
1
vote
1answer
105 views

Distinguish between local function calls and external(imported) function calls in a dynamic trace

I know that when IDA pro want to disassemble a binary and label the functions, employs import address table and IDA flirt to distinguish from local functions and external functions! Now I have ...
1
vote
1answer
164 views

How to distinguish Functions boundaries, entry points and instructions in instruction trace

I have an instruction trace which is collected form a binary analysis platform and I already convert it to assembly instructions. I want to extract all functions and function calls in the file but ...
2
votes
1answer
420 views

Visual studio memory allocation reverse engineering

I compile this code with Visual studio 2010 compiler: #include "stdafx.h" #include <iostream> int main() { int *p; p = new int(255); delete []p; } The disassembly of it, is different ...
3
votes
1answer
413 views

Computing subtracted stack space for a function manually

Lets assume this function frame : How to calculate and check if subtracted stack space by line 3 is 58h ?: sub esp, 58h And this is the code, the compiler is also Dev C++: #include <stdio.h> ...
5
votes
2answers
644 views

Understanding the loop disassembly

Here is the code of loop that I'm trying to understand the disassembly of it: #include<stdio.h> #include <iostream> using namespace std; int main() { int i, arr[50], num; printf("...
2
votes
2answers
402 views

Binary diffing: Why moving ebx to eax, instead of pushing ebx?

I was doing binary diffing, I want to know why mov eax,ebx is used instead of push ebx. This is the binary diffing image: Before patch : After patch :
1
vote
1answer
335 views

Working with unsupported binary formats

Sometimes I can't start debugging binary due to being unsupported format for example in IDA. For example I found a Nintendo 3DS game and want to debug it. But the problem is that I can't start ...
0
votes
0answers
511 views

Decompress NAND dump (custom LZ77/LZSS?)

I'm trying to to reverse engineer a very old STB (it was in service between 2005 and 2014). I successfully dumped the NAND of the box but I'm struggling with the compression used. Here is an extract ...
-1
votes
2answers
450 views

Decoding binary - basics [closed]

I'm trying to decode this binary file which is from a cache. All I want is the playlist metadata. I am getting some of it using a simple hex viewer, but the majority of the information is random ...
3
votes
2answers
810 views

Patching a Mach-O Binary Header to remove a LC_SEGMENT

i have an ARMv7 Mach-O Executable on which I want to patch out a certain segment in the binary header which prevents DYLD injection. more information here under point 3. of preventing dyld injection....
6
votes
1answer
7k views

Which python library for parsing Linux ELF files?

I want to be able to parse 32 and 64 bit ELF files - but not create or modify them (e.g. as discussed in this thread). The ELF binaries may possibly come from embedded Linux systems, that is, the ...
9
votes
2answers
1k views

Protect data stored in binary

Let's say I've some function(i.e. hash function), that generates value from input seed and some precomputed hash values, that are stored somewhere in binary. What are the possible approaches for: ...
2
votes
3answers
1k views

About the VB P-CODE mode reverse-engineer

I have to reverse-engineer a VB P-CODE mode program. I had the program's P-CODE, but I don't know what it means. For example: Proc: 421840 421100: 04 FLdRfVar local_0098 421103: 04 ...
1
vote
1answer
157 views

Is there anyway I can iterate all the C-level statements in IDA-Pro?

I am trying to iterate all the C statement (could be very coarse-grained, it's fine) in IDA-Pro recovered assembly program. Suppose I only consider these statements: State :: = | if-else cond; |...
1
vote
1answer
218 views

Where can I learn about code instrumentation?

Currently I am learning about profiling parallel programs. All the profilers heavily use all kinds of instrumentations but this topic is not well explained. Do you know any good sources from which I ...
9
votes
2answers
6k views

How do you can you disassemble and dump an entire binary?

It's easy to seek to a particular function and dump it's contents as Assembly language. However, I cannot find an obvious way to immediately disassemble and dump an entire binary. I want to use it ...
4
votes
1answer
2k views

Reverse engineering a proprietary GPU device driver?

I have the binary file, and it's over 200 MB in size, which makes me think that such a task by myself would be beyond incredibly difficult to get anything done. I am trying to see how the driver ...
1
vote
0answers
61 views

Constructing a mesh from triangle data (plane, svec, tvec) [closed]

I am trying to obtain some mesh data from a game which stores its collision surfaces for props/models in an array of "CollTri" structures which looks like this (taken from the limited source code I ...
1
vote
1answer
129 views

How to find what code created some data?

I'd like to be able to point to a buffer in memory likely on the heap and have a tool tell me which part of the binary created the data in the file. What tools can do that for me?
1
vote
1answer
1k views

Router firmware modification and MIPS executable under x86_64 Ubuntu [X-POST from unix.stackexchange.com]

X-POST FROM unix.stackexchange.com I'm currently trying to make modifications to a router firmware: Swisscom Centro Grande - aka Pirelli Vx226N1, firmware version: 60200. I've decompiled it ...
6
votes
2answers
20k views

Extract files from a bin firmware

I have a firmware image that is used for flashing a BMW NBT navigation system that I want to research. I did a binwalk on the file (dump below). I want to extract the individual files, especially the ...
1
vote
1answer
300 views

Where can i download malware variants [duplicate]

How/Where can i get variants of a malware ? The only thing that concerns is that the variants must be a continuous update of the previous one
6
votes
1answer
815 views

Reversing simple message + checksum pairs (32 bytes)

I am trying to determine the algorithm behind a 32-byte protected section of memory on a big-endian system. It will render invalid if even a single bit is changed, but I can generate any number of ...
2
votes
1answer
1k views

What are the open source symbolic execution tools for windows binaries

I want to test some approach in symbolic execution in windows binaries and doesn't want to write a new one from scratch and also this tool must be reliable at research levels. I found S2E and ...
2
votes
0answers
54 views

How to know the C++ try/throw/catch block size and address from machine code? [duplicate]

I'm doing a project that reorders basic blocks inside a function at runtime in C++ under 64-bit Linux. The reordering process includes updating instructions like "jmp". One problem is that if the ...
5
votes
1answer
6k views

Decrypting firmware: Is there a true “format” to it, and how does it differ from decryping other files?

I have firmware for a system and I'm trying to decrypt some of it just for the sake of seeing what it all does; nothing illegal or anything like that, such as reproducing copies of it decrypted and ...
3
votes
1answer
1k views

Check if binary was compiled with security checks (/GS)

I have to check massive amount of binaries whether they were compiled with the /GS option. I assume a good indicator would be to check if they have stack cookie or not. Do you know any tool that can ...
1
vote
1answer
316 views

How do I find non-exported symbols of a binary?

You can use nm(liux/mac) to find exported and imported functions/symbols, is it possible to find the non-exported symbols of a binary in a similar way? Are there command line tools to assist with this?...
1
vote
0answers
306 views

Why the extracted content differs?

I used binwalk to extract firmware.bin image, the extracted content is squashfs-root dir, and a separate dpc.squashfs file. Then I used sasquatch utility to extract content of dpc.squashfs file, and I ...
3
votes
1answer
1k views

OllyDbg: Keep comments & labels in rebased DLL

My program loads and unloads a DLL of main interest at runtime. I try to add comments and labels to the DLLs code, but when it is unloaded and loaded again, they are gone, as the DLL is rebased most ...
6
votes
1answer
2k views

Reverse-engineering a tough-to-crack video game save-file checksum

Been trying to figure this one out for a while now, and would be eternally grateful for anyone with more experience in checksum algorithms lending a hand. I've been trying to alter save files for an ...