Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [binary-analysis]

The process of gathering information about a binary file, either with static or dynamic methods.

7
votes
1answer
3k views

Unpack IpCam firmware - Binwalk extraction issue

I'm trying to use Binwalk to extract an IpCam bin firmware. I did it successfully for the WebUI, but I can't on the firmware itself. Hardware : Vstarcam C7824WIP Firmware : CH-sys-48.53.64.67.zip ...
5
votes
1answer
336 views

Challenging variable-length integer encoding

I have a piece of binary data I'm trying to investigate. My guess is that it should be part of simple filesystem-like index. There are 2 parts in the file. First part has a very simple format: number ...
6
votes
1answer
420 views

Difference between Win7 and Win8 PE loader?

Is it known what the differences between the Window 7 and Windows 8 PE loader are? I'm trying to hand-craft a simple executable PE image file. It runs well in Windows 7, but is rejected by Windows 8....
3
votes
0answers
593 views

Reverse engineer TPMS sensor data

I'm trying to reverse engineer data received from TPMS (car tire pressure) sensors. I was able to receive and demodulate the data (433 MHz, FSK, Manchester encoding). Probable packet fields: ...
2
votes
1answer
512 views

Analyzing a Login Process

I am reverse engineering a program that uses a custom auth protocol. This is a basic outline of the process: Client takes input for username and password, then sends username to the auth server. Auth ...
0
votes
1answer
2k views

Decode 96 column punch card

I don't know if this is the right place to ask, but I can't seem to find it anywhere on the internet: How do I read a 96 column IBM system/3 punch card? I am doing an exercise but I can't seem to ...
3
votes
0answers
805 views

Analysing eCos image

I'm working on unpacking a firmware image. I've already uncompressed the original image, but I'm stuck in the current step. This is the current uncompressed image: https://www.dropbox.com/s/...
7
votes
1answer
1k views

Reverse engineering Earthsiege 2 3D model format

As a personal project I've been trying to reverse engineer the art assets for the old Dynamix game Earthsiege 2 (this game has long been abandonware and was recently released for free by Hi-Rez, the ...
5
votes
1answer
372 views

How to read these UV coordinates?

I'm trying to reverse engineer 3D models (cars) from a racing game from 1997 (Test Drive 4). I'm able to extract the 3D mesh and textures, but cannot figure out how UV mapping works yet. There is ...
0
votes
2answers
1k views

Obtaining memory locations of local variables

For ELF binaries on Linux, if the executable is not stripped, it is possible to recover memory locations of location variables in the form of relative addresses to stack/frame pointer? As an example, ...
2
votes
0answers
529 views

Reverse engineering TPMS sensor data [closed]

I'm trying to reverse engineer data received from TPMS (car tyre pressure) sensors. I used rtl_433 tool to capture the data from sensor at 433 MHz. Tool was able to detect data is using FSK modulation ...
1
vote
2answers
328 views

How hard is it to interpret binary data of a new and unknown format, if it's unknown what data is encoded?

This question is based off of my answer to a world building question: https://worldbuilding.stackexchange.com/questions/30471/how-could-a-blind-alien-race-interpret-video-broadcast-into-space/30497?...
0
votes
0answers
102 views

Locate compressed section of executable

I am playing with Philips DICOM Viewer - download version R3.0 SP3. This viewer can display DICOM information (press F9). Since the displayed strings are not stored in the DICOM file itself, I suspect ...
0
votes
1answer
54 views

Callee's return precalculations

Good day. I build this simple code on Intel cpu working on Windows 7 with MS VS Express 2013: #include <stdio.h> int f(int a, int b, int c); int f(int a, int b, int c){ int d = a*b + c; ...
1
vote
1answer
281 views

Variable liveness analysis on binaries

I want to detect all the variables live at any instruction/address in a binary. By variable, I refer to both global as well as function local variables. In other words, given a Linux ELF and a virtual ...
2
votes
0answers
78 views

How can I further identify a file which the file command lists as 'data' [closed]

I have file named 'out'. If I issue the file command I see : :~/Desktop# file out out: data How can I further identify what type of file this is? Interestingly, if I execute the file, I see a '...
4
votes
2answers
409 views

Locating Memory Allocation Functions from Static Analysis

I'm currently working on reversing a firmware binary for an embedded device. This device is using an uncommon architecture: it is a modified Harvard architecture, running on a TMS320C55x chipset with ...
0
votes
2answers
181 views

How to identify the structure of this specific data file? [closed]

What is the structure of this database file from an old videogame? https://www.dropbox.com/s/ioe26pi3y1w3320/TMDATA1.S8?dl=0 Apologies in advance because fixing specific problems is not really the ...
1
vote
1answer
410 views

Binary Instrumentation of malware binaries?

I am developing a dynamic instrumentation tool using Intel PIN to analyze malware binaries in windows. From what I have learned so far is that I am able to use the tool with programs I write using C/C+...
2
votes
0answers
674 views

IDA Pro user-defined offsets (again)

I'm disassembling a simple Z80 program and can't for the life of me work out how to - successfully - specify a user-defined offset. I have a line of code as: ld de, #0x6058 and FTR, this address ...
2
votes
1answer
764 views

How to reverse engineer a database file format?

It is an accounting database whose database file format is proprietary data. But the problem is the database is highly unreliable, corruption go unnoticed for years after which it becomes unbearably ...
4
votes
3answers
948 views

Automatically decode PUSH+RET call into JMP

While reversing a piece of malware I've faced with anti-disasm trick, that actually is well described here. So my question is: would the assembly patching of whole the PUSH+RET stubs to JMP(i.e. C3-> ...
0
votes
1answer
139 views

Does anybody know which tools allow to get (pseudo) code from a Moscow ML executable?

I've decompiled Win32 executable that is the result of compilation of a program written in Moscow ML language. The resulting listing contains standard C main function that contains the call to ...
1
vote
1answer
369 views

Specific byte purpose in header of little endian ARM binary

I have a little endian 32-bit ARM binary, compiled for a CPU that's running embedded Linux. I want to figure out what a specific byte in the binary means. An example hex view of the first few bytes of ...
3
votes
2answers
279 views

One-pass streaming algorithm for detecting bytecode/opcode?

I am searching for an algorithm and/or snippet of code that provides a one-pass algorithm over a steady datastream that can detect a valid sequence of bytecode or opcode. There are no PE32, ELF, or ...
4
votes
1answer
987 views

Reverse engineer 4-bit CRC in LG IR packet

I am reverse engineering IR protocol of LG air conditioner. AC generally send the whole current state of remote on each key press. Data sent is 28 bits long, last 4 bits seem to be the checksum. I ...
0
votes
0answers
308 views

Intercepting syscall in a shared object (dynamically linked)

Ditto. Any technique that allows to intercept sys calls issued from a shared object file? At runtime, the shared object is dlopen'ed by main(). One candidate is to use static binary rewriting (e.g. ...
1
vote
3answers
550 views

Dump global datas to disk in assembly code

the experiment is on Linux, x86 32-bit. So suppose in my assembly program, I need to periodically (for instance every time after executing 100000 basic blocks) dump an array in .bss section from ...
4
votes
4answers
973 views

Why are PUSHF and POPF so slow?

the experiment is on 32-bit x86 Linux. I am doing some static binary instrumentation work, and basically I am trying to insert some instructions below to the beginning of every basic block. BB23 : ...
2
votes
1answer
125 views

Tracing variable access/usage instructions

There is a great little closed-source freeware Windows program (written in Delphi) that I have been using for years. WinBar shows a little bar above the TaskBar which gives some system information and ...
1
vote
1answer
106 views

Distinguish between local function calls and external(imported) function calls in a dynamic trace

I know that when IDA pro want to disassemble a binary and label the functions, employs import address table and IDA flirt to distinguish from local functions and external functions! Now I have ...
1
vote
1answer
170 views

How to distinguish Functions boundaries, entry points and instructions in instruction trace

I have an instruction trace which is collected form a binary analysis platform and I already convert it to assembly instructions. I want to extract all functions and function calls in the file but ...
2
votes
1answer
430 views

Visual studio memory allocation reverse engineering

I compile this code with Visual studio 2010 compiler: #include "stdafx.h" #include <iostream> int main() { int *p; p = new int(255); delete []p; } The disassembly of it, is different ...
3
votes
1answer
446 views

Computing subtracted stack space for a function manually

Lets assume this function frame : How to calculate and check if subtracted stack space by line 3 is 58h ?: sub esp, 58h And this is the code, the compiler is also Dev C++: #include <stdio.h> ...
5
votes
2answers
655 views

Understanding the loop disassembly

Here is the code of loop that I'm trying to understand the disassembly of it: #include<stdio.h> #include <iostream> using namespace std; int main() { int i, arr[50], num; printf("...
2
votes
2answers
411 views

Binary diffing: Why moving ebx to eax, instead of pushing ebx?

I was doing binary diffing, I want to know why mov eax,ebx is used instead of push ebx. This is the binary diffing image: Before patch : After patch :
1
vote
1answer
355 views

Working with unsupported binary formats

Sometimes I can't start debugging binary due to being unsupported format for example in IDA. For example I found a Nintendo 3DS game and want to debug it. But the problem is that I can't start ...
0
votes
0answers
525 views

Decompress NAND dump (custom LZ77/LZSS?)

I'm trying to to reverse engineer a very old STB (it was in service between 2005 and 2014). I successfully dumped the NAND of the box but I'm struggling with the compression used. Here is an extract ...
-1
votes
2answers
489 views

Decoding binary - basics [closed]

I'm trying to decode this binary file which is from a cache. All I want is the playlist metadata. I am getting some of it using a simple hex viewer, but the majority of the information is random ...
3
votes
2answers
870 views

Patching a Mach-O Binary Header to remove a LC_SEGMENT

i have an ARMv7 Mach-O Executable on which I want to patch out a certain segment in the binary header which prevents DYLD injection. more information here under point 3. of preventing dyld injection....
6
votes
1answer
8k views

Which python library for parsing Linux ELF files?

I want to be able to parse 32 and 64 bit ELF files - but not create or modify them (e.g. as discussed in this thread). The ELF binaries may possibly come from embedded Linux systems, that is, the ...
9
votes
2answers
1k views

Protect data stored in binary

Let's say I've some function(i.e. hash function), that generates value from input seed and some precomputed hash values, that are stored somewhere in binary. What are the possible approaches for: ...
2
votes
3answers
1k views

About the VB P-CODE mode reverse-engineer

I have to reverse-engineer a VB P-CODE mode program. I had the program's P-CODE, but I don't know what it means. For example: Proc: 421840 421100: 04 FLdRfVar local_0098 421103: 04 ...
1
vote
1answer
161 views

Is there anyway I can iterate all the C-level statements in IDA-Pro?

I am trying to iterate all the C statement (could be very coarse-grained, it's fine) in IDA-Pro recovered assembly program. Suppose I only consider these statements: State :: = | if-else cond; |...
1
vote
1answer
224 views

Where can I learn about code instrumentation?

Currently I am learning about profiling parallel programs. All the profilers heavily use all kinds of instrumentations but this topic is not well explained. Do you know any good sources from which I ...
9
votes
2answers
7k views

How do you can you disassemble and dump an entire binary?

It's easy to seek to a particular function and dump it's contents as Assembly language. However, I cannot find an obvious way to immediately disassemble and dump an entire binary. I want to use it ...
4
votes
1answer
2k views

Reverse engineering a proprietary GPU device driver?

I have the binary file, and it's over 200 MB in size, which makes me think that such a task by myself would be beyond incredibly difficult to get anything done. I am trying to see how the driver ...
1
vote
0answers
62 views

Constructing a mesh from triangle data (plane, svec, tvec) [closed]

I am trying to obtain some mesh data from a game which stores its collision surfaces for props/models in an array of "CollTri" structures which looks like this (taken from the limited source code I ...
1
vote
1answer
129 views

How to find what code created some data?

I'd like to be able to point to a buffer in memory likely on the heap and have a tool tell me which part of the binary created the data in the file. What tools can do that for me?
1
vote
1answer
1k views

Router firmware modification and MIPS executable under x86_64 Ubuntu [X-POST from unix.stackexchange.com]

X-POST FROM unix.stackexchange.com I'm currently trying to make modifications to a router firmware: Swisscom Centro Grande - aka Pirelli Vx226N1, firmware version: 60200. I've decompiled it ...