Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [binary-analysis]

The process of gathering information about a binary file, either with static or dynamic methods.

2
votes
1answer
946 views

IDA Pro only recognizes my files as BINARY

I am trying to disassemble some various files, and IDA does not recognize them. Is there anyway to add more file types to IDA Pro? I am running ida 6.5
5
votes
3answers
3k views

Is learning assembly enough to become a malware analyst? [closed]

I am a C/C++ developer and I have started learning assembly language programming with the goal to become a malware analyst. I know it is not enough to just know how to read assembly to become a ...
-4
votes
2answers
831 views

Bin file is not only storing 0s and 1s, ASCII or otherwise

Upon checking out a binary file, and according to convincing evidence, .bin file extensions are supposed to denote a file type which stores its data as 0s and 1s, or 31/32 in ASCII hex(ASCII character ...
4
votes
1answer
296 views

Reverse engineering in pairs - is it possible?

I'm interested if anyone can share from his experience how to analyze complex binaries in pairs - 2 RE engineers. Are there any suitable methodologies, tools to help in such work? UPDATE This is ...
5
votes
1answer
2k views

IDA Pro for MIPS image

I have this file: [ytti@lintukoto ~/tmp/ida]% file cat3k_caa-universalk9.SPA.03.03.00.SE.150-1.EZ.bin cat3k_caa-universalk9.SPA.03.03.00.SE.150-1.EZ.bin: data It's image for Cisco Catalyst 3650 ...
8
votes
2answers
2k views

Decoding an ancient format

It's a very interesting file format may greatly satisfies binary archaeologists. sample file Background This file format was created in 90s to archive customer created AutoCAD components library ...
2
votes
2answers
3k views

Decoding a blob

I have a proprietary file format that is a compressed database file. This database file has a few dozen tables. Each of these tables only have a few records, many of them don't have any records at all....
20
votes
4answers
5k views

Tool or data for analysis of binary code to detect CPU architecture

Assuming that I have binary file with code for unknow CPU can I somehow detect cpu architecture? I know that it depends mostly on compiler but I think that for most of CPU architectures it should be ...
6
votes
2answers
5k views

unpack Clear spot .bin firmware update

I am trying to unpack a clear spot firmware update The firmware I am trying to reverse can be found on the download page of the vendor I have used the fwtools to unpack the firmware as described on ...
11
votes
3answers
5k views

Totally unknown file analysis approaches

I guess this is the worst case. I have a file which was initially base64 encoded. This step was easy. But now all I can see is a bunch of rubbish. No structure, nearlly a maximum of entropy, no ...
3
votes
1answer
1k views

Recreating 2D aspects of Cantor.dust

I'm trying to recreate some of the 2D capabilities that were demonstrated in cantor.dust, I was wondering if anyone knows how they translate a large file(executable) into a number of different images /...
9
votes
2answers
909 views

Binary instrumentation with Python

I'm interested in performing (dynamic) binary instrumentation using Python to be able to analyze the binary by instructions during execution for Windows Linux Can someone suggest such tool/framework?...
4
votes
1answer
2k views

How to reverse command line arguments?

I am working on a console windows executable. So far what I figured out is that the executable checks number of command line arguments. Afterwards, it branches out depending on the number of arguments ...
12
votes
2answers
13k views

Extract SquashFS filesystem with shsq magic number

for a few days I was trying to extract the filesystem of a router firmware. Checking the image that the vendor provides I can see a SquashFS flag on it: DECIMAL HEX DESCRIPTION -----------...
14
votes
2answers
2k views

Why are GOT and PLT still present in Linux static stripped binaries?

I am looking at statically linked linux x86 stripped binary. I noticed that there are .got and .plt sections. I wonder what does a statically linked binary need got and plt sections for ? Anyone ?
4
votes
1answer
3k views

Find file signatures inside an unknown file

I have a .bin file I would like to analyse. Especially find images embedded in this firmware update. binwalk couldn't find anything. What other tools do you know to search for possible embedded ...
5
votes
2answers
337 views

Find level data in binaries?

I am trying to recreate an old game just for the sake of nostalgia and learning something new alongside (I can program in various languages and know a bit of assembly language, but I'm new to reverse ...
5
votes
4answers
12k views

Is there any tool for decompiling raw binary files to C code for the Motorola 68000 processor series?

I have the ROM dump (.bin files) targeted for the MC68008 processor. Need to convert them into a high level source code. I have already found tools for disassmbling them into assembly code. The next ...
5
votes
4answers
2k views

Is BinNavi available? If not, can I get the source from anywhere?

BinNavi is originally a Zynamics product. But, since the company has been bought by Google, it seems to be difficult to get the library. I tried to look in the BinNavi manual in the installation ...
66
votes
2answers
49k views

What is PLT/GOT?

From time to time, when disassembling x86 binaries, I stumble on reference to PLT and GOT, especially when calling procedures from a dynamic library. For example, when running a program in gdb: (gdb)...
4
votes
1answer
540 views

On SPARC, what happens when a branch is placed in the branch-delay slot of another branch?

Our team recently had to look at SPARC assembly specifications, the problem is that I do not have a SPARC processor to try things on it (I should set up a simulator or get one of these old Sparc ...
13
votes
5answers
985 views

How do you store your data about a binary while performing analysis?

Since now, when I am analyzing a binary, I'm using a "pen and paper" method to locate the different location of the function, the different type of obfuscations, and all my discoveries. It is quite ...
46
votes
7answers
21k views

how can I diff two x86 binaries at assembly code level?

I'm looking for a tool like Beyond Compare, meld, kdiff, etc. which can be used to compare two disassembled binaries. I know that there's binary (hex) comparison, which shows difference by hex values, ...
10
votes
1answer
2k views

What are the main features of radare2?

Radare2 is a framework for reverse-engineering gathering several tools (see this Phrack article about radare1 to know a bit more about the framework). I would like to know if someone could point out ...
9
votes
1answer
1k views

What are the differences between BitBlaze and BAP?

BitBlaze and BAP are two platforms to perform binary analysis. And, if I understand well, they are sharing lots of common features. What are their respective main features and in what do they differ ...
18
votes
4answers
5k views

What is “overlapping instructions” obfuscation?

I analyzed some binaries in x86/x86-64 using some obfuscation tricks. One was called overlapping instructions. Can someone explain how does this obfuscation work and how to work around?
11
votes
3answers
6k views

Reverse engineer an old DOS QBasic executable

I recently decided to try my hand at reverse engineer an old DOS text based game that was coded in QBasic. I found some info online about old DOS games disassembly but mostly for Wacom compiled C/C++ ...
5
votes
1answer
241 views

What is the scalability of state of the art static binary analysis techniques?

What is the largest program that has been analyzed by a semantics-based static binary analysis? By semantics-based, I mean an analysis that examines the meaning of the program, and does not simply ...