Questions tagged [binary-analysis]
The process of gathering information about a binary file, either with static or dynamic methods.
562
questions
143
votes
2
answers
131k
views
What is PLT/GOT?
From time to time, when disassembling x86 binaries, I stumble on
reference to PLT and GOT, especially when calling procedures from a
dynamic library.
For example, when running a program in gdb:
(gdb)...
- 19.2k
94
votes
9
answers
320k
views
How do I reverse-engineer .so files found in Android APKs?
I know how to reverse-engineer normal Android APKs using tools like apktool and dex2jar, but I don't know how to work with obfuscation.
When I extract everything from APK, I get some Smali files (I ...
- 1,215
63
votes
8
answers
39k
views
how can I diff two x86 binaries at assembly code level?
I'm looking for a tool like Beyond Compare, meld, kdiff, etc. which can be used to compare two disassembled binaries. I know that there's binary (hex) comparison, which shows difference by hex values, ...
- 4,845
62
votes
7
answers
17k
views
Visualizing ELF binaries
I recently saw an older talk by Sergey Bratus and Greg Conti by the name of Voyage of the Reverser: A Visual Study of Binary Species.
Are there any opensource/free tools that one could use to see ...
user1743
56
votes
7
answers
160k
views
How to know in which language/technology program (.exe) is written?
How to understand if exe/dll is written in C++/.Net/Java or in any other language. I tried to use Dependency walker but not able to get required information.
- 927
25
votes
6
answers
9k
views
Tool or data for analysis of binary code to detect CPU architecture
Assuming that I have binary file with code for an unknown CPU, can I somehow detect the CPU architecture? I know that it depends mostly on the compiler, but I think that for most CPU architectures it ...
- 385
23
votes
4
answers
8k
views
What is "overlapping instructions" obfuscation?
I analyzed some binaries in x86/x86-64 using some obfuscation tricks. One was called overlapping instructions. Can someone explain how does this obfuscation work and how to work around?
- 19.2k
20
votes
2
answers
6k
views
Why are GOT and PLT still present in Linux static stripped binaries?
I am looking at statically linked linux x86 stripped binary. I noticed that there are .got and .plt sections.
I wonder what does a statically linked binary need got and plt sections for ? Anyone ?
- 603
18
votes
1
answer
24k
views
Approach to extract useful information from binary file
The purpose of this question is to gain an understanding of the concepts behind reverse engineering and to understand what approaches may be taken to extract useful information from a binary file.
I'...
- 195
18
votes
4
answers
16k
views
How to generate the call graph of a binary file?
I have a non-stripped ELF binary for which I want to create a call graph as a dot file. Is there such a tool which generates the call graph?
EDIT: Is there away in addition to the conventional call ...
- 677
17
votes
3
answers
8k
views
Parsing/Rescuing corrupted IDA database
I'm reversing an application with IDA.
My VM crashed and left the IDA database in a corrupted unpacked state.
The next time I tried to load it back, IDA gave me the following error message: The ...
- 2,038
16
votes
2
answers
3k
views
Decoding an unknown image format with "DREK" signature (*.drk)
There are some unknow images, which I would like to decode to RRGGBBAA format. It was a really hard work, but at the moment I can somewhat understand, that which part of the binary is responsible for ...
- 214
16
votes
3
answers
5k
views
Code Coverage - Fuzzing
I have been fuzzing Adobe Reader lately.
One of the issues that I face is Code coverage. How do I determine that I have covered all the basic blocks in Adobe Reader and it's libraries.
Is there any ...
- 595
16
votes
2
answers
21k
views
Extract SquashFS filesystem with shsq magic number
for a few days I was trying to extract the filesystem of a router firmware. Checking the image that the vendor provides I can see a SquashFS flag on it:
DECIMAL HEX DESCRIPTION
-----------...
- 725
15
votes
2
answers
11k
views
What are some ways to pass raw bytes to a program via the Linux terminal?
I want to pass raw bytes to a (C) program using the Linux Bash shell. I find that when I try to pass for example "\x00\xFF\xAB", the program receiving the input actually gets the ASCII character codes ...
- 1,880
15
votes
3
answers
12k
views
What Linux software can I use to explore entropy of a file?
I've heard of tools that could be used to graph entropy of a file. Is there a graphical Linux program that I could use for this job that would let me conveniently explore which blocks of a file have ...
- 327
14
votes
3
answers
26k
views
Remove code signature from a Mac binary
How can I remove the code signature from a binary so that I can patch it without the binary refusing to run afterwards?
Needless to say, I'm not the original creator of the binary, nor I have the ...
- 297
13
votes
5
answers
1k
views
How do you store your data about a binary while performing analysis?
Since now, when I am analyzing a binary, I'm using a "pen and paper" method to locate the different location of the function, the different type of obfuscations, and all my discoveries. It is quite ...
- 19.2k
13
votes
3
answers
9k
views
Totally unknown file analysis approaches
I guess this is the worst case. I have a file which was initially base64 encoded. This step was easy. But now all I can see is a bunch of rubbish. No structure, nearlly a maximum of entropy, no ...
- 231
13
votes
1
answer
3k
views
Extracting strings from Go binaries
Is there an easy way to extract all of the strings from Go binaries that will work cross architecture?
The problem with Go is that strings are stored without a null terminator, so you can't use the &...
- 231
12
votes
2
answers
14k
views
Why I can not directly get the content of `.bss` section?
Test is on Linux 32bit.
I use this command to get the context of .text .rodata and .data section:
objdump -s -j .text elf_binary
objdump -s -j .rodata elf_binary
objdump -s -j .data elf_binary
But ...
- 2,485
12
votes
3
answers
9k
views
Reverse engineer an old DOS QBasic executable
I recently decided to try my hand at reverse engineer an old DOS text based game that was coded in QBasic.
I found some info online about old DOS games disassembly but mostly for Wacom compiled C/C++ ...
- 121
12
votes
4
answers
6k
views
Why do reversers nowadays reverse engineer using decompilers and not disassemblers?
I see many reverse engineering lessons and every second person does reverse engineer using Ghidra decompiler and not disassembler as both are available in the same platform. I assume that reversing ...
- 323
12
votes
2
answers
5k
views
Extract non-extractable private key from OS X Keychain
I'm trying to extract a non-extractable private key as a .p12 file from Keychain Access.app or /usr/bin/security on Mac OS X 10.9.4.
Basically, it appears that security import has a -x option to ...
- 299
11
votes
1
answer
6k
views
How to make radare2 work for a large binary?
I compiled cpython with debugging headers and I want to perform the following analysis using radare2.
The problem I encounter is that it takes forever (at least 27 hours) to perform the aaa (...
- 677
11
votes
2
answers
3k
views
Protect data stored in binary
Let's say I've some function(i.e. hash function), that generates value from input seed and some precomputed hash values, that are stored somewhere in binary. What are the possible approaches for:
...
- 823
11
votes
1
answer
3k
views
What are the main features of radare2?
Radare2 is a framework for reverse-engineering gathering several tools (see this Phrack article about radare1 to know a bit more about the framework).
I would like to know if someone could point out ...
- 19.2k
11
votes
2
answers
16k
views
Which python library for parsing Linux ELF files?
I want to be able to parse 32 and 64 bit ELF files - but not create or modify them (e.g. as discussed in this thread). The ELF binaries may possibly come from embedded Linux systems, that is, the ...
- 1,560
10
votes
4
answers
4k
views
Control flow graph reconstruction projects
I'm looking for projects providing reconstructed Control Flow Graphs from binaries while supporting more than one platform (e.g. x86, x64, arm). For example, considering this short assembler program:
...
- 2,906
10
votes
2
answers
13k
views
How do you can you disassemble and dump an entire binary?
It's easy to seek to a particular function and dump it's contents as Assembly language. However, I cannot find an obvious way to immediately disassemble and dump an entire binary. I want to use it ...
- 1,258
10
votes
1
answer
2k
views
Finding the actual Thumb code in firmware
I'm planning to buy my first mechanical keyboard, a KBT Poker II, and apart from the physical characteristics of it, another thing that caught my attention is that it sports reflashable firmware! ...
- 203
10
votes
1
answer
1k
views
Static analysis data combined with dynamic analysis knowledge
What I'm doing now is placing an awful lot of comments about function variable values, global variable values as comments in my IDA database, which I find ugly after a while and obviously not a best ...
- 2,038
10
votes
2
answers
1k
views
Binary instrumentation with Python
I'm interested in performing (dynamic) binary instrumentation using Python to be able to analyze the binary by instructions during execution for
Windows
Linux
Can someone suggest such tool/framework?...
- 3,062
10
votes
2
answers
8k
views
How to load symbols from a symbol server in Ghidra?
I've been trying to learn Ghidra by attempting to reverse the comctl32.dll system library, which has many of its functions documented. I started the de-compilation analysis in it, and after a while it ...
- 1,751
10
votes
1
answer
6k
views
Can I define custom enum-type to be used in Ghidra as a data type?
I'm trying to learn Ghidra. Say, if it generated the following code for loading functions from an array of function names from gpfnCommCtrlAPI:
I was able to retype gpfnCommCtrlAPI into char*[14] ...
- 1,751
9
votes
3
answers
11k
views
Extracting a NAND flash dump with OOB data
I'm trying to extract a NAND flash dump of an old Walkman player. The dump was done by a friend and unfortunately cannot be redone because the chip was destroyed.
The dump was supposed to be just user ...
- 36.9k
9
votes
1
answer
2k
views
What are the differences between BitBlaze and BAP?
BitBlaze and BAP are two platforms to perform binary analysis. And, if I understand well, they are sharing lots of common features. What are their respective main features and in what do they differ ...
- 19.2k
9
votes
2
answers
2k
views
Decoding an ancient format
It's a very interesting file format may greatly satisfies binary archaeologists. sample file
Background
This file format was created in 90s to archive customer created AutoCAD components library ...
8
votes
1
answer
5k
views
Zte Reverse engineering config.bin file problem
I just got a Zte ZXHN F660 GPON ONT Wireless router with my optic fiber internet provided by my telecom provider.
My first discovery was that the eth Lan ports are bricked wich
means I can only use ...
8
votes
1
answer
1k
views
Reverse engineer TPMS sensor data
I'm trying to reverse engineer data received from TPMS (car tire pressure) sensors. I was able to receive and demodulate the data (433 MHz, FSK, Manchester encoding).
Probable packet fields:
bytes 1-...
- 253
8
votes
0
answers
957
views
Analyzing a Revit project file
I've been messing around with Revit and trying to understand the internal data structures for its file format. I'm not particularly experienced with this type of work and the processes around reverse ...
- 81
7
votes
2
answers
18k
views
Import table vs Import Address Table
What's the difference between the Import Table and the Import Address Table?
- 437
7
votes
2
answers
22k
views
What's the difference between a disassembler, debugger and decompiler?
I have heard of disassemblers like IDA and debuggers like OllyDbg but honestly, when you give both of them a binary file it gives me the assembly code. I know that the decompiler gives the source code ...
- 1,215
7
votes
4
answers
2k
views
Is there any tool to quantitatively evaluate the difference of binary?
I know some binary diff tool like VBinDiff and others.
Currently I have a large number of binary, around 500.
So I am looking for a binary tool to quantitatively evaluate the difference of binaries.....
- 2,485
7
votes
3
answers
7k
views
unpack Clear spot .bin firmware update
I am trying to unpack a clear spot firmware update
The firmware I am trying to reverse can be found on the download page of the vendor
I have used the fwtools to unpack the firmware as described on ...
- 71
7
votes
4
answers
25k
views
Is there any tool for decompiling raw binary files to C code for the Motorola 68000 processor series?
I have the ROM dump (.bin files) targeted for the MC68008 processor. Need to convert them into a high level source code. I have already found tools for disassmbling them into assembly code. The next ...
7
votes
2
answers
2k
views
Reverse engineering Windows Defender's signature for Metasploit Framework's metsrv.dll
As a pentester for a consulting agency, it is part of our job to "evade" antivirus after gaining code execution on information systems. It is indeed necessary to prove exploitation of vulnerabilities, ...
- 143
7
votes
2
answers
2k
views
Radare2 Find command line arguments and location in stack
This might have a simple solution but I can't find it anywhere.
$> ./be1 11 AAAAA
With gdb, finding argv[] and argc is simple:
(gdb) print argv[0]@argc
$7 = {0xbffff872 "be1", 0xbffff89a "11", ...
- 175
7
votes
1
answer
4k
views
Unpack IpCam firmware - Binwalk extraction issue
I'm trying to use Binwalk to extract an IpCam bin firmware. I did it successfully for the WebUI, but I can't on the firmware itself.
Hardware : Vstarcam C7824WIP
Firmware : CH-sys-48.53.64.67.zip
...
- 73
7
votes
1
answer
2k
views
Reverse engineering Earthsiege 2 3D model format
As a personal project I've been trying to reverse engineer the art assets for the old Dynamix game Earthsiege 2 (this game has long been abandonware and was recently released for free by Hi-Rez, the ...
- 173