Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [binary-analysis]

The process of gathering information about a binary file, either with static or dynamic methods.

66
votes
2answers
49k views

What is PLT/GOT?

From time to time, when disassembling x86 binaries, I stumble on reference to PLT and GOT, especially when calling procedures from a dynamic library. For example, when running a program in gdb: (gdb)...
53
votes
7answers
148k views

How do I reverse engineer .so files found in android APKs?

I know how to reverse engineer normal android APKs using tools like APK-tool anddex2jar but i don't know how to work with obfuscation. Can anyone help or atleast provide some pointers? I know this ...
46
votes
7answers
21k views

how can I diff two x86 binaries at assembly code level?

I'm looking for a tool like Beyond Compare, meld, kdiff, etc. which can be used to compare two disassembled binaries. I know that there's binary (hex) comparison, which shows difference by hex values, ...
41
votes
7answers
82k views

How to know in which language/technology program (.exe) is written?

How to understand if exe/dll is written in C++/.Net/Java or in any other language. I tried to use Dependency walker but not able to get required information.
20
votes
4answers
5k views

Tool or data for analysis of binary code to detect CPU architecture

Assuming that I have binary file with code for unknow CPU can I somehow detect cpu architecture? I know that it depends mostly on compiler but I think that for most of CPU architectures it should be ...
18
votes
4answers
5k views

What is “overlapping instructions” obfuscation?

I analyzed some binaries in x86/x86-64 using some obfuscation tricks. One was called overlapping instructions. Can someone explain how does this obfuscation work and how to work around?
16
votes
3answers
4k views

Parsing/Rescuing corrupted IDA database

I'm reversing an application with IDA. My VM crashed and left the IDA database in a corrupted unpacked state. The next time I tried to load it back, IDA gave me the following error message: The ...
15
votes
1answer
2k views

Decoding an unknown image format with “DREK” signature (*.drk)

There are some unknow images, which I would like to decode to RRGGBBAA format. It was a really hard work, but at the moment I can somewhat understand, that which part of the binary is responsible for ...
14
votes
2answers
2k views

Why are GOT and PLT still present in Linux static stripped binaries?

I am looking at statically linked linux x86 stripped binary. I noticed that there are .got and .plt sections. I wonder what does a statically linked binary need got and plt sections for ? Anyone ?
13
votes
5answers
985 views

How do you store your data about a binary while performing analysis?

Since now, when I am analyzing a binary, I'm using a "pen and paper" method to locate the different location of the function, the different type of obfuscations, and all my discoveries. It is quite ...
12
votes
2answers
4k views

Code Coverage - Fuzzing

I have been fuzzing Adobe Reader lately. One of the issues that I face is Code coverage. How do I determine that I have covered all the basic blocks in Adobe Reader and it's libraries. Is there any ...
12
votes
3answers
4k views

How to generate the call graph of a binary file?

I have a non-stripped ELF binary for which I want to create a call graph as a dot file. Is there such a tool which generates the call graph? EDIT: Is there away in addition to the conventional call ...
12
votes
2answers
13k views

Extract SquashFS filesystem with shsq magic number

for a few days I was trying to extract the filesystem of a router firmware. Checking the image that the vendor provides I can see a SquashFS flag on it: DECIMAL HEX DESCRIPTION -----------...
11
votes
1answer
10k views

Approach to extract useful information from binary file

The purpose of this question is to gain an understanding of the concepts behind reverse engineering and to understand what approaches may be taken to extract useful information from a binary file. I'...
11
votes
3answers
6k views

Reverse engineer an old DOS QBasic executable

I recently decided to try my hand at reverse engineer an old DOS text based game that was coded in QBasic. I found some info online about old DOS games disassembly but mostly for Wacom compiled C/C++ ...
11
votes
3answers
5k views

Totally unknown file analysis approaches

I guess this is the worst case. I have a file which was initially base64 encoded. This step was easy. But now all I can see is a bunch of rubbish. No structure, nearlly a maximum of entropy, no ...
10
votes
1answer
2k views

What are the main features of radare2?

Radare2 is a framework for reverse-engineering gathering several tools (see this Phrack article about radare1 to know a bit more about the framework). I would like to know if someone could point out ...
10
votes
1answer
2k views

Finding the actual Thumb code in firmware

I'm planning to buy my first mechanical keyboard, a KBT Poker II, and apart from the physical characteristics of it, another thing that caught my attention is that it sports reflashable firmware! ...
10
votes
1answer
699 views

Static analysis data combined with dynamic analysis knowledge

What I'm doing now is placing an awful lot of comments about function variable values, global variable values as comments in my IDA database, which I find ugly after a while and obviously not a best ...
10
votes
2answers
2k views

Extract non-extractable private key from OS X Keychain

I'm trying to extract a non-extractable private key as a .p12 file from Keychain Access.app or /usr/bin/security on Mac OS X 10.9.4. Basically, it appears that security import has a -x option to ...
9
votes
2answers
6k views

Why I can not directly get the content of `.bss` section?

Test is on Linux 32bit. I use this command to get the context of .text .rodata and .data section: objdump -s -j .text elf_binary objdump -s -j .rodata elf_binary objdump -s -j .data elf_binary But ...
9
votes
2answers
5k views

What Linux software can I use to explore entropy of a file?

I've heard of tools that could be used to graph entropy of a file. Is there a graphical Linux program that I could use for this job that would let me conveniently explore which blocks of a file have ...
9
votes
2answers
1k views

Protect data stored in binary

Let's say I've some function(i.e. hash function), that generates value from input seed and some precomputed hash values, that are stored somewhere in binary. What are the possible approaches for: ...
9
votes
2answers
6k views

How do you can you disassemble and dump an entire binary?

It's easy to seek to a particular function and dump it's contents as Assembly language. However, I cannot find an obvious way to immediately disassemble and dump an entire binary. I want to use it ...
9
votes
2answers
909 views

Binary instrumentation with Python

I'm interested in performing (dynamic) binary instrumentation using Python to be able to analyze the binary by instructions during execution for Windows Linux Can someone suggest such tool/framework?...
9
votes
1answer
1k views

What are the differences between BitBlaze and BAP?

BitBlaze and BAP are two platforms to perform binary analysis. And, if I understand well, they are sharing lots of common features. What are their respective main features and in what do they differ ...
8
votes
3answers
2k views

Control flow graph reconstruction projects

I'm looking for projects providing reconstructed Control Flow Graphs from binaries while supporting more than one platform (e.g. x86, x64, arm). For example, considering this short assembler program: ...
8
votes
2answers
2k views

Decoding an ancient format

It's a very interesting file format may greatly satisfies binary archaeologists. sample file Background This file format was created in 90s to archive customer created AutoCAD components library ...
8
votes
1answer
276 views

Byte frequencies in different architectures' binaries?

what I'm looking for I have a binary that, for various reasons, I'm pretty sure is executable machine code (although possibly for a VM language, although I doubt it's Java). I'm looking for a table ...
7
votes
3answers
3k views

Extracting a NAND flash dump with OOB data

I'm trying to extract a NAND flash dump of an old Walkman player. The dump was done by a friend and unfortunately cannot be redone because the chip was destroyed. The dump was supposed to be just user ...
7
votes
4answers
1k views

What is the “standard” approach to find loop in binary code?

I am working on some x86 (32/64 bits) ELF binary code. These binaries are compiled from C and C++ program code and I am trying to detect loops inside the binaries. I am newbie to this area, and I am ...
7
votes
4answers
1k views

Is there any tool to quantitatively evaluate the difference of binary?

I know some binary diff tool like VBinDiff and others. Currently I have a large number of binary, around 500. So I am looking for a binary tool to quantitatively evaluate the difference of binaries.....
7
votes
2answers
633 views

Radare2 Find command line arguments and location in stack

This might have a simple solution but I can't find it anywhere. $> ./be1 11 AAAAA With gdb, finding argv[] and argc is simple: (gdb) print argv[0]@argc $7 = {0xbffff872 "be1", 0xbffff89a "11", ...
7
votes
2answers
277 views

Reverse engineering Windows Defender's signature for Metasploit Framework's metsrv.dll

As a pentester for a consulting agency, it is part of our job to "evade" antivirus after gaining code execution on information systems. It is indeed necessary to prove exploitation of vulnerabilities, ...
7
votes
1answer
1k views

Reverse engineering Earthsiege 2 3D model format

As a personal project I've been trying to reverse engineer the art assets for the old Dynamix game Earthsiege 2 (this game has long been abandonware and was recently released for free by Hi-Rez, the ...
7
votes
0answers
167 views

Analyzing a Revit project file

I've been messing around with Revit and trying to understand the internal data structures for its file format. I'm not particularly experienced with this type of work and the processes around reverse ...
6
votes
1answer
2k views

How to make radare2 work for a large binary?

I compiled cpython with debugging headers and I want to perform the following analysis using radare2. The problem I encounter is that it takes forever (at least 27 hours) to perform the aaa (...
6
votes
2answers
20k views

Extract files from a bin firmware

I have a firmware image that is used for flashing a BMW NBT navigation system that I want to research. I did a binwalk on the file (dump below). I want to extract the individual files, especially the ...
6
votes
1answer
845 views

I need quick correction on this x86 opcode conundrum

I am trying to figure out how to encode the instruction MOV DS, AX, but I am confused from the opcode table as follows: Is MOV DS all one byte, or is MOV one byte, DS the second, and the AX the third?...
6
votes
2answers
5k views

unpack Clear spot .bin firmware update

I am trying to unpack a clear spot firmware update The firmware I am trying to reverse can be found on the download page of the vendor I have used the fwtools to unpack the firmware as described on ...
6
votes
3answers
1k views

Running a binary identified as an ARM excutable by binwalk --disasm

I have a Philips 10FF2 picture frame I'm trying to reverse engineer. In the firmware download from the Philips website (http://download.p4c.philips.com/files/1/10ff2cme_00/10ff2cme_00_fus_aen.zip) I ...
6
votes
2answers
581 views

Reverse engineering Perl-compatible regular-expressions

I'm dealing with a piece of malware that does extensive use of PCRE (Perl-compatible regular expressions). Normally I would be able to read them, but it seems they're in some kind of binary format (...
6
votes
1answer
2k views

Zte Reverse engineering config.bin file problem

I just got a Zte ZXHN F660 GPON ONT Wireless router with my optic fiber internet provided by my telecom provider. My first discovery was that the eth Lan ports are bricked wich means I can only use ...
6
votes
1answer
2k views

Unpack IpCam firmware - Binwalk extraction issue

I'm trying to use Binwalk to extract an IpCam bin firmware. I did it successfully for the WebUI, but I can't on the firmware itself. Hardware : Vstarcam C7824WIP Firmware : CH-sys-48.53.64.67.zip ...
6
votes
1answer
7k views

Which python library for parsing Linux ELF files?

I want to be able to parse 32 and 64 bit ELF files - but not create or modify them (e.g. as discussed in this thread). The ELF binaries may possibly come from embedded Linux systems, that is, the ...
6
votes
1answer
815 views

Reversing simple message + checksum pairs (32 bytes)

I am trying to determine the algorithm behind a 32-byte protected section of memory on a big-endian system. It will render invalid if even a single bit is changed, but I can generate any number of ...
6
votes
1answer
2k views

Reverse-engineering a tough-to-crack video game save-file checksum

Been trying to figure this one out for a while now, and would be eternally grateful for anyone with more experience in checksum algorithms lending a hand. I've been trying to alter save files for an ...
6
votes
1answer
415 views

Difference between Win7 and Win8 PE loader?

Is it known what the differences between the Window 7 and Windows 8 PE loader are? I'm trying to hand-craft a simple executable PE image file. It runs well in Windows 7, but is rejected by Windows 8....
5
votes
3answers
3k views

Is learning assembly enough to become a malware analyst? [closed]

I am a C/C++ developer and I have started learning assembly language programming with the goal to become a malware analyst. I know it is not enough to just know how to read assembly to become a ...
5
votes
2answers
644 views

Understanding the loop disassembly

Here is the code of loop that I'm trying to understand the disassembly of it: #include<stdio.h> #include <iostream> using namespace std; int main() { int i, arr[50], num; printf("...