Questions tagged [binary-analysis]

The process of gathering information about a binary file, either with static or dynamic methods.

92 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
9
votes
0answers
566 views

Extracting strings from Go binaries

Is there an easy way to extract all of the strings from Go binaries that will work cross architecture? The problem with Go is that strings are stored without a null terminator, so you can't use the &...
7
votes
0answers
590 views

Analyzing a Revit project file

I've been messing around with Revit and trying to understand the internal data structures for its file format. I'm not particularly experienced with this type of work and the processes around reverse ...
5
votes
0answers
181 views

Radare2 8051 code bank switching

Some of 8051 chips use bank switching to extend accessible code memory. Good example is Silabs C8051F12x. Another example is here. Code area in range 0x0000..0x7ffff is common always accessible code ...
4
votes
1answer
196 views

Are there existing automated approaches to reverse engineering the data types in a binary data stream?

Consider a stream of data packets of a known and consistent size, i.e., N bytes per packet. Are there existing tools that automatically detect (or estimate) the various data types present and their ...
4
votes
0answers
89 views

JTAG Dumped Flash is scrambled

I dumped the flash memory of an old ARM9 Chip running VxWorks using the SEGGER J-Link and the savebin command from J-Link Commander. Here is an example of a line of HTML stored on memory. <!DOC^...
4
votes
0answers
613 views

How do I perform concolic execution with Angr and collect constraints on input?

I have a program that takes a string (with some structure) as input. My aim is to collect information on what values each character in input is compared to as it gets parsed using concolic execution. ...
3
votes
1answer
136 views

Review a collection of executable binaries to determine similarity

I have a collection of different binaries I want to review for code similarity and classification, but I would rather not have to open each of them in IDA and manually review the code in 15 different ...
3
votes
1answer
1k views

How to extract DVB firmware bin file?

I have a bin file of DVB (DTH) box firmware. I want to change one image inside that bin file, how I can do this? Please guide me in right direction. I tried bin walk, but the file that it extracted ...
3
votes
0answers
980 views

Reverse-engineering DOS game's data files

I would like to figure out the data format used by an old DOS game I used to play when I was a kid. That link includes a full download for all the files and it runs fine in DOSBox if you want to try ...
3
votes
0answers
2k views

Analysing eCos image

I'm working on unpacking a firmware image. I've already uncompressed the original image, but I'm stuck in the current step. This is the current uncompressed image: https://www.dropbox.com/s/...
3
votes
0answers
408 views

How is the tp-link switch firmware obfuscated?

I was curious and wanted to learn a bit about TP-Link's switch firmware (for example: What OS are they using?). Because I have seen the sg3216 in the real world, I thought, I'd start with that one. ...
2
votes
0answers
66 views

How to modify checksum after making changes in Nokia 215 4G firmware?

If I change any character in the firmware file and try to flash it, it will failed. But it will successfully flashed if I changed the string with the same number of character if it's not a function. ...
2
votes
0answers
151 views

Modify bin firmware file of an old phone

I am trying to remove/disable some system apps ( Messages, Games, Radio or Calendar ) and remove/replace the boot screen from samsung E1200y. So i start searching for the way to do that... I used HxH ...
2
votes
0answers
77 views

Advice for retrieving functions and tables from Intel 8061/8065 bin file (reverse engineering) from Ford EECV ECU

I have under my disposal some Ford EECV bin files and my goal for the next few weeks is to retrieve the functions and tables, and plot them out before going onto DIY hardware. Does anyone know which ...
2
votes
0answers
133 views

submitting input into AFL fuzzer

I have some questions about the AFL Fuzzer: How does the AFL Fuzzer know where to inject the payload in the code I compile? For instance if I want to inject it in a specific parameter, how do I do it?...
2
votes
0answers
175 views

What's the pattern in this sequence extracted from a LYR document, used by the ESRI ArcGIS

I'm trying to reverse engineer a binary format, and I'm running up against a variable-length sequence of numbers which varies between files. I can't work out the pattern here and how to determine how ...
2
votes
0answers
136 views

Google Maps, Android serialisation format

I've come across an SQLite database (gmm_storage.db) used by Google Maps on Android, and I'm unsure as to how the data it contains is serialised. For example: I'm saying serialised, as from the ...
2
votes
0answers
767 views

Extracting firmware image from binary

I have firmware file in .bin format, but I need get firmware.img image file and Kernel uImage file for reflashing bricked device. How can I get these parts? I used Binwalk to extract content, ...
2
votes
1answer
145 views

What is actually loaded here and different hexdump outputs on util-linux hexdump and on cutter and ghidra's hexdump

I was trying to understand what segment of file gets loaded by fourth LOAD header on phdr array. First 6 headers are shown below from readelf Program Headers: Type Offset ...
2
votes
0answers
45 views

How do I decode arbitrary data from a raw extracted binary?

I have a IoT scale that stores my measurements into records and passes them onto my phone. I was able to read directly off a flash chip and create a binary file. The chipset is ARMv7. I want to be ...
2
votes
1answer
4k views

How to decrypt the config.bin from ZTE ZXV10 H201L

I have this file from my router its backup of user config,I suppose its compresed with zlib and encrypted with AES. Utility which is resposible to compress it and encrypt it is called cspd. In side ...
2
votes
0answers
929 views

IDA Pro user-defined offsets (again)

I'm disassembling a simple Z80 program and can't for the life of me work out how to - successfully - specify a user-defined offset. I have a line of code as: ld de, #0x6058 and FTR, this address ...
2
votes
0answers
228 views

What is the difference between Software Architecture Recovery and Software Remodularization in the context of Reverse Engineering?

In the reverse engineering scenario, after extracting a representation of the code, it is often useful to recover/ reconstruct the architecture of the software (for eg. when reverse engineering java ...
1
vote
0answers
45 views

Unknown binary format (.scp) - No Header

I hope everyone is doing well. I've recently been trying to decode the structure of some files that contain a lot Unicode-8 IIRC characters, with a mix of binary. When I put it into IDA, I can't seem ...
1
vote
0answers
30 views

How to find references for a string (where it is being called) in Go binary

I have a Go binary and I have this string: When I go to its location, with IDA Pro, and tries to find all the references (using x) I am getting a message that there are no references: It might be ...
1
vote
0answers
153 views

Repacking vmlinux into zImage/bzimage

While RE an embedded device I ran into a problem - I need to patch a check in the kernel which has no sources available. Unpacking the kernel and binary-patching went smoothly. However I cannot get ...
1
vote
0answers
79 views

What type of file has the file signature 'BOOT'?

I have a .bin file which I am trying to disassemble into something that I can edit. Given that binary files can contain just about any binary data, I found it difficult to assess what file data is ...
1
vote
0answers
34 views

PE Format - How can I delete IMAGE_IAT_DIRECTORY and the app still runs fine?

I’m doing a small research regarding PE files and while I drilled every related question or the documentation itself I couldn’t explain this issue. Why can I go to CFF explorer or some other PE ...
1
vote
0answers
79 views

What to do with a text file of disassembly code and binaries?

I am fairly new to software reverse engineering and I'd like to know how proceed with analyzing a program if I have a text file of disassembly code and a bin file of binary data. I understand ...
1
vote
0answers
42 views

dwarf: variable offset from base

I have a simple code: int main() { int a = 4; printf("%d\n", a); a = 8; if (a == 8) printf("%d\n", a); return 0; } DIEs for the function and variable: <1><32a>: Abbrev ...
1
vote
0answers
45 views

Main contemporary deobfuscation techniques

Could you please specify in a few words main contemporary deobfuscation techniques which we can apply to 32/64 bit PE files? For example, (1) using instruction templates, such as: mov edx, 5B1F04F1h ...
1
vote
0answers
14 views

Locating Exit/Abort Functions from Static Analysis

Similar to this question, I'm interested in locating exit and abort style functions in a firmware - any function call that in fact terminates the execution, by statically analyzing the firmware. My ...
1
vote
0answers
175 views

Extract files of a SquashFS Filesystem

I already asked a similar question but after a deeper analysis of the filesystem I found out that I misunderstood the problem and that's why I decided to delete the old question and make a new one. I ...
1
vote
0answers
92 views

Static binary instrumentation

I am working on a class project. I need to find out static features of a program (without executing it). Backward branches (loops) Conditional branches (potential threads with load imbalance) ...
1
vote
1answer
489 views

pyelftools relocation section symbols

I have been trying to get into reverse engineering as of late and after playing with Radare2 I realized I was playing with a lot of things without really understanding what I was doing. In an effort ...
1
vote
0answers
102 views

Reproduce compilation (ASM) output for library detection - identifying compiler, version & options used

I want to reverse a stripped x86 sample that uses a static library. So far I could identify the library itself and narrow the version of the library used. Now I want to use Ghidra's Function ID ...
1
vote
0answers
124 views

Using IDA to find pointer passed to procedure

Loading the source into IDA, I have this function: According to the source for Lua, this function should be passed a pointer to the Lua_State struct: LUA_API int lua_gettop (lua_State *L) { return ...
1
vote
0answers
221 views

Vulnerabilities of Binary executed by root

I was given a vulnerable 64bit dynamically linked stripped that runs simple checks to determine the strength of the passwords of users on a linux system. The app checks if it the EUID is 0 and then ...
1
vote
0answers
99 views

Argument types not identified when parsing declarations

I'm trying to add a dynamic import segment in the IDA database which contains functions names, and I'm applying type information to it, so that I can obtain argument locations by using ...
1
vote
0answers
201 views

How can a segfault happen during the libc exit call on Linux?

I'm relatively new to reverse engineering, and I've decided to practise using the challenges from pwnable.tw. Currently, I am working on the "Silver Bullet" challenge. While testing, I have noticed ...
1
vote
0answers
68 views

Is there any way to capture the state of an application so as to restore execution of it later?

There are certain older, non-DirectX-based games that I can hack inside of a VM, which is amazing because I can save snapshots of states to then restore if, say, the game crashes after I attempt ...
1
vote
0answers
287 views

Naruto Uzumaki Chronicles 2 .RAW Files [PS2]

I'm have been trying to mod these game for years, but I still stuck with the raw files from RACJIN games, [same case as Fullmetal Alchemist & Bleach]. The files appear to be compressed, and a ...
1
vote
0answers
321 views

What is the format of this binary file?

I have a binary file that I found on a 3D printer that is used to program a dsPIC30F5011 microcontroller. It is responsible for some basic data encryption. The only problem is, I am not sure how this ...
1
vote
0answers
59 views

How to make sense of this one pin serial communication

I am trying to reverse engineer a serial communication between to microcontrollers (1 device & 1 microcontroller on a board). One MCU validates the other MCU and I want to crack the validation and ...
1
vote
0answers
283 views

Stack buffer overflow SIGSEGV help

I've been going at this for a couple of days now working through trial and error but I can't seem to pinpoint exactly why I'm still getting a SIGSEGV. Here's the stdout of me stepping through the ...
1
vote
0answers
1k views

My core dump's backtrace stops to a signal handler, what can I do?

I obtained an ELF core dump that was provoked by fuzzing a proprietary server. As I do not have access anymore to the machine that hosted this server, and the server is part of a tightly coupled set ...
1
vote
0answers
295 views

Accessing .rodata/.rel.data.ro

Analyzing an android ELF binary. How/where does something access a specific area of .rodata or .rel.data.ro? Have tried using objdump, rabin2, readelf, etc and I can't seem to figure out how it is ...
1
vote
0answers
281 views

Analyzing Game Map/Terrain Format

I'm trying to understand how this game builds the map and terrain. Specially if it uses a heightmap. So I can write an app that can view the map and move around (camera) freely. First, I'm not ...
1
vote
0answers
740 views

How can I find loading adress of eCos image

Hey guys Im trying to find loading address (entry point of my program) for this binary, which is part off this firmware. Im trying to load it inside of IDA, how can I correctly load it, how to find ...
1
vote
0answers
107 views

Record-replay tools for Windows?

Are there any user-mode record-replay tools for Windows that can capture native execution of a program so that it can be replayed deterministically later? Instructions, memory accesses, syscalls and ...