Questions tagged [binary-analysis]

The process of gathering information about a binary file, either with static or dynamic methods.

Filter by
Sorted by
Tagged with
50
votes
7answers
124k views

How to know in which language/technology program (.exe) is written?

How to understand if exe/dll is written in C++/.Net/Java or in any other language. I tried to use Dependency walker but not able to get required information.
0
votes
1answer
114 views

Advanced Binary Exploitation CTF

I wanted to ask your assistance: Where can I find advanced ctfs (that hopefully contain solutions) regarding binary/kernel exploitation? I am interested on finding x86_64 linux/windows/arm64 that ...
4
votes
1answer
165 views

Are there existing automated approaches to reverse engineering the data types in a binary data stream?

Consider a stream of data packets of a known and consistent size, i.e., N bytes per packet. Are there existing tools that automatically detect (or estimate) the various data types present and their ...
2
votes
1answer
131 views

What is actually loaded here and different hexdump outputs on util-linux hexdump and on cutter and ghidra's hexdump

I was trying to understand what segment of file gets loaded by fourth LOAD header on phdr array. First 6 headers are shown below from readelf Program Headers: Type Offset ...
4
votes
2answers
803 views

Identification of D-Link firmware checksum and adding it to OpenWrt firmware

I have this D-Link firmware and would like to identify checksum type used on it and add it to OpenWrt bin file so I could upgrade firmware to OpenWrt instead default crappy D-Link. I did tried to ...
0
votes
0answers
27 views

Reverse engineering encrypted router backup config file

My router has a config backup function that downloads a base64-encoded file. After decoding the file, it's clear that it is encrypted: I have tried redownloading the config, both after having changed ...
0
votes
0answers
27 views

Nokia 105(TA-1114) Firmware analysis using Binwalk

First please forgive me if a make any mistake. i am not a primarily English speaker but I will try my best. Few days ago i started to tinkering with Nokia feature phone Nokia 105(TA-1114). I get a ...
-1
votes
1answer
53 views

Instrument memory accesses of python scripts

My research requires processing memory traces of applications. For C/C++ programs, this is easy using Intel's PIN library. However, as suggested here https://stackoverflow.com/questions/51835532/use-...
1
vote
0answers
28 views

How to modify checksum after making changes in Nokia 215 4G firmware?

If I change any character in the firmware file and try to flash it, it will failed. But it will successfully flashed if I changed the string with the same number of character if it's not a function. ...
0
votes
1answer
28 views

The Logic Of Incremental Data on Serial Communication Encoding

These are the serial communication reverse values. I am trying to understand the logic behind this. I am pretty sure that 2 bytes represent 1 byte(high byte and low byte), values are correct. I tried ...
0
votes
1answer
63 views

Getting the object name through the Ghidra Script

I have a script written to work with ghidra. I am doing some analysis in the script and save the results in a file. Right now, I am passing the name when a prompt ask the file name to save upon ...
0
votes
0answers
60 views

Help to find the main menu apps in Nokia firmware

I am trying to custom Nokia 215 4G firmware I want to remove specific apps like games, radio, browser... If not removing it, redirecting it OR even damage it. So when you click on an app it will open ...
-1
votes
2answers
574 views

Getting the function's original file name within Ghidra

I am trying to extract the original file name of some functions through Ghidra. In particular I have enabled the debug symbols so that it does contains the function names in the disassembly listing ...
0
votes
0answers
29 views

What type of file has the file signature 'BOOT'?

I have a .bin file which I am trying to disassemble into something that I can edit. Given that binary files can contain just about any binary data, I found it difficult to assess what file data is ...
0
votes
1answer
134 views

How to identify/extract relevant assembly from a binary?

Say I was interested in reverse engineering a specific process in a large binary, say how Google Chrome parses XML, what are some general approaches to identifying the instructions that the program ...
1
vote
3answers
908 views

Is it possible copy and save bootloader using CLI telnet commands?

I need get copy of original Bootloader from device running embedded Linux. Is it possible copy and save bootloader using CLI telnet commands? I have full access to CLI interface. Is there way copy ...
2
votes
1answer
3k views

How to decrypt the config.bin from ZTE ZXV10 H201L

I have this file from my router its backup of user config,I suppose its compresed with zlib and encrypted with AES. Utility which is resposible to compress it and encrypt it is called cspd. In side ...
0
votes
1answer
74 views

Why compiler is doing this?

While I was disassembling my own C code for practice I saw an interesting point which I want to share with you guys and needs to know the answer as I always get from here. Now, the interesting point ...
1
vote
1answer
422 views

pyelftools relocation section symbols

I have been trying to get into reverse engineering as of late and after playing with Radare2 I realized I was playing with a lot of things without really understanding what I was doing. In an effort ...
5
votes
1answer
3k views

Reverse engineering a proprietary GPU device driver?

I have the binary file, and it's over 200 MB in size, which makes me think that such a task by myself would be beyond incredibly difficult to get anything done. I am trying to see how the driver ...
2
votes
1answer
286 views

How to extract information from a binary file knowing the target info

I have some measured data comes from a various types of sensors. The sensors are connected to a data-logger in order to store measurement data. After measurement, the data transported and stored in a ...
0
votes
1answer
61 views

How to export arm64 and x86-64 binary into one?

I am trying to export a binary that contains both AARCH64-64 and x86-64 in Ghidra. I only opened the x86-64 counterpart to perform some changes. When I tried to export it, it exported a .bin file that ...
0
votes
2answers
149 views

What should I learn in order to reverse elf64 binary files

I'm a little confused. I am using a Linux based system (Ubuntu), 64-bit. and I want to start and reverse 64elf binary files, but there is a lot of things I want to know before. just to be clear, If I ...
0
votes
0answers
42 views

Understand the AES encryption mode

I am reverse engineering a software that implements its own encryption over HTTP. The implementation is very simple, the client has the server's public key which it uses to encrypt the data it sends ...
1
vote
1answer
131 views

Arrays assembly

I'm reversing my C array's programs where I'm storing numbers in arrays like this... int marks[5]; marks[0] = 1; marks[1] = 3; marks[2] = 2; marks[3] = 7; marks[4] = 9; so the compiler showing me the ...
1
vote
1answer
123 views

Questions regarding PLT/GOT and statically linking

I am looking at the assembly code of a heap-overflow challenge (heap3 in Protostar) which uses a vulnerability of an old version of dlmalloc to execute the exploit. Below is the assembler dump: ...
0
votes
0answers
62 views

How to Find Password/ Bypass Password in a Switch Statement using IDA

I'm new to reverse engineering, wondering how access or bypass the password contained in the switch statement ? File Link
2
votes
1answer
87 views

Not able to understand the C-switch statement in disassembly

While I'm trying to disassemble my own C code I am stuck in a problem of not understanding how this Switch statement is implemented in assembly code. Can anyone please help to figure it out? This the ...
0
votes
0answers
31 views

IDAPython NtCreateFile

Let's say I want to print the filenames on every call to NtCreateFile (With %any% exe loaded in IDA ) The first problem is to get the ntdll!NtCreateFile address Tried to do it like this ...
4
votes
2answers
210 views

Why do reversers nowadays reverse engineer using decompilers and not disassemblers?

I see many reverse engineering lessons and every second person does reverse engineer using Ghidra decompiler and not disassembler as both are available in the same platform. I assume that reversing ...
0
votes
0answers
49 views

Control flow graph of entire binary file

Is it possible to get the control flow graph of the entire binary file using any disassembler? IDA Pro generates the CFG for each function. Can we use it to get the CFG of the entire program?
0
votes
0answers
45 views

Possible ways to reverse enginerring the boot file

I am trying to take files from the file called LOADING.KWI it is the boot file for multimedia, located on the loading sdhc card, which should be inserted in multimedia's slot, without this card the ...
3
votes
1answer
119 views

Review a collection of executable binaries to determine similarity

I have a collection of different binaries I want to review for code similarity and classification, but I would rather not have to open each of them in IDA and manually review the code in 15 different ...
0
votes
0answers
61 views

finding a not-so-straightforward game's function

I am working on Mad Max game [ APEX engine ] I do my best to explain the situation. so my target executes function like this: there are commands like " call [eax+XX] " or " call RX &...
0
votes
1answer
231 views

How to reverse engineer Apple MacBook SMC update firmware image using IDA Pro 7.2?

Alright so I have watched extraordinary presentations videos from three different reverse engineers who hacked the Apple SMC Update firmware: Charlie Miller: https://www.youtube.com/watch?v=...
3
votes
3answers
5k views

Speedport entry 2i zte home router's firmware

I was searching through my routers admin page some time ago and I've noticed that it doesn't support firmware updates by the user(it's an ISP's speedport entry 2i router(zte variant)). So long story ...
0
votes
1answer
32 views

How to force a program to run as monothread for dynamic analysis?

I'm reversing a program with x64dbg and ida (I switched from ghidra), hence disassembled and decompiled, I need to understand what is happening with dynamic analysis, but I have a tricky part where ...
3
votes
2answers
74 views

How to figure out functionality when doing Static Code Analysis in ASM?

When doing Static code analysis on a disassembled app, I usually end up seeing many calls to registers (CALL EAX for example), which is constructed in runtime, which leaves me clueless on how to ...
-1
votes
1answer
390 views

Disassembling code with Hopper

I'm trying to figure out what this code is doing. The first thing that I don't understand is the condition that tests if arg0's value is 0x2. I read that 0x2 in ASCII is STX (Start of text). Here's ...
0
votes
1answer
42 views

IDAPython, parse IDA DB as PE file

I have buffer loaded into IDA with IDAPython in a costume loader script, I want to now to be parsed as a PE, or in fact, it would be better if IDA will try to reparse it as a PE, is it possible ...
2
votes
0answers
118 views

Modify bin firmware file of an old phone

I am trying to remove/disable some system apps ( Messages, Games, Radio or Calendar ) and remove/replace the boot screen from samsung E1200y. So i start searching for the way to do that... I used HxH ...
2
votes
1answer
174 views

The Knowledge of Compiler for becoming a good Reverser

I just reached the the topic of Compilers in the book "Reversing:Secrets of Reverse Engineering" So, I want to ask, is the knowledge of Compilers necessary for becoming a Malware Reverse ...
0
votes
1answer
57 views

usercalls in old Win32 game

I am currently analyzing an old Win32 game from 1999 that was probably compiled with Visual C++ 6 and was programmed in C. I noticed that there are almost no usercalls (i.e. calls that use registers ...
3
votes
1answer
1k views

OllyDbg: Keep comments & labels in rebased DLL

My program loads and unloads a DLL of main interest at runtime. I try to add comments and labels to the DLLs code, but when it is unloaded and loaded again, they are gone, as the DLL is rebased most ...
1
vote
4answers
92 views

finding sequence of opcode in binary

I have dis-assmebled binary and want to check if it contains particular sequence of opcodes(obtained from other reference binary). how to do that . i know plain byte level comparison wont work as as ...
21
votes
6answers
7k views

Tool or data for analysis of binary code to detect CPU architecture

Assuming that I have binary file with code for unknow CPU can I somehow detect cpu architecture? I know that it depends mostly on compiler but I think that for most of CPU architectures it should be ...
2
votes
2answers
89 views

C++ structure containing a RTTI getter function?

I'm working on reversing a C++ application and I've come across a structure that contains a getter function that returns TypeDescriptor*, I've read some articles on RTTI and reversing C++ but can't ...
0
votes
0answers
33 views

Issue Debugging in IDA PRO

I am analyzing a binary file to retrieve the password. It requires a userID and password. By analyzing I need to crack the password. But after running through IDA it is being terminated. First, I used ...
0
votes
1answer
2k views

x86-64 CALL opcode + disassembly

Working a basic buffer overflow on a 64bit system and putting together some basic shellcode. The main program does a call to puts@plt. When I disassemble main in gdb, the opcodes show as: e8 6b fe ff ...
0
votes
0answers
35 views

What is .data.rel.ro used for in GO on Linux?

I'm reversing a GO binary, and I was trying to locate where some symbols appear in the binary. I did the following: Used nm on the binary - which did not recognize any symbols Used go tool nm - same ...

1
2 3 4 5
10