Questions tagged [binary-analysis]

The process of gathering information about a binary file, either with static or dynamic methods.

Filter by
Sorted by
Tagged with
1 vote
0 answers
21 views

How to reverse Engineer a Struct in IDA Pro?

How to identify and define a struct in IDA pro Decompiling during reverse engineering? Please explain the easiest way to figure out the struct in IDA Pro decompilation! To make life easier are there ...
Jose I. Hughes's user avatar
3 votes
0 answers
126 views

How to analyze Dynamic import resolving malware?

How to analyze a runtime Dynamic import resolving malware? What are the best ways to do that kind of analysis? Windows malware analysis.
Jose I. Hughes's user avatar
2 votes
0 answers
42 views

Please help identify which type of CPU architecture is used on obscure portable media players

I am trying to reverse engineer a media player with obscure SigmaTel SoCs just for fun but I didn't find very useful information. As far as I don't know exactly what CPU architecture is used on these ...
Andy's user avatar
  • 21
3 votes
1 answer
112 views

What type of bin is this file?

Can someone help me what type of BIN file is that and can i read what is inside ? Thanks https://easyupload.io/673djh
johnz's user avatar
  • 31
3 votes
0 answers
65 views

PEStudio DLL analysis: flag in export section

I start to use PEStudio for DLL analysis; I understand (more or less) everything, except the "exports (flag)" section: What does it mean the X in the flag column? So, what is a/the flag? ...
Gianluca's user avatar
  • 131
1 vote
0 answers
114 views

Get all names of functions from an iOS-App binary (headless)

Setup: I want to get a list of all (apple built-in) function and variable names that are used in an arbitrary iOS App by headless analysis. So given the .ipa file of any iOS-App, I unpack it and can ...
Kühlhausvogel's user avatar
4 votes
1 answer
107 views

💻 This code does not crash on ARM (qemu). Why?

I found a couple of interesting integer underflows leading to memcpy() wild copies in a TLV parser process of some random IoT firmware. It is 32-bit ARMv7. I'm able to emulate the userspace process ...
Attila Szász's user avatar
4 votes
1 answer
155 views

Mickey Mouse toy bin file analysis

I am trying to reverse engineer a Mickey Mouse toy just for fun but I am stuck. The toy has several buttons that play various phrases and songs. My aim was to see if I can read those songs from the ...
George Farcas's user avatar
4 votes
0 answers
104 views

How to assemble back a disassembled Linux kernel?

I have a Linux kernel file and I need to tweak the contents of its corresponding initramfs. I did it in the past for standard distros where kernel and initramfs were separate. However, this specific ...
Peter's user avatar
  • 141
3 votes
1 answer
50 views

GNU strings with --encoding=S

I have two binaries. Both contain the string "precondition failed" (without the quotes). The corresponding byte sequence 70 72 65 63 6C 65 64 00 is the same for both binaries. However, the ...
langlauf.io's user avatar
  • 1,518
2 votes
2 answers
69 views

Decoding a list of integer values in unknown format

I'm attempting to reverse engineer a binary file format which is used to encode a list of integer values. I can't work out how this format works, as the number of bytes used to encode each value ...
ndawson's user avatar
  • 73
2 votes
0 answers
56 views

Buffer overflow gets() weird parsing

I'm attempting to do a buffer overflow with gets(). I've figured out how to write over the return address and I'm able to do so, however, I cannot write in the address I need because the 0x7F at the ...
user42774's user avatar
3 votes
0 answers
34 views

How can I quickly tell which ARM Thumb version a particular piece of code is using?

I'm working with an ARM processor: an STM32F407VGT6 board, which IIUC powers a 32-bit Arm® Cortex®-M4. I need to inspect the binary weight of some instruction, so I used objdump like this: arm-none-...
Alessandro Bertulli's user avatar
3 votes
1 answer
338 views

U-boot base address on Ghidra

I'm trying to do some REing on a vendored U-Boot bootloader image. For context, the U-Boot image was extracted from the full firmware image with: dd if=<firmware>.img of=uboot_sdcard.bin bs=1024 ...
Rui Oliveira's user avatar
2 votes
0 answers
38 views

Find out what is this binary database entry and what format it is

the following varbinary "BUFFER" of a database entry is for an article. FIELD_0 is in plain text and the item name is "1", which I created with the item management software. [...
Chrischi's user avatar
2 votes
0 answers
43 views

How to obtain import name from disassembled assembly

I'm trying to create my own tools for reverse engineering PE. I have some assembly codes that I fetched from a clone of objdump for a program. Sometimes I see call instructions such as : callq *...
onerom's user avatar
  • 21
2 votes
1 answer
327 views

Trying to reverse a bin file

I'm trying to reverser a bin file with Ghidra, without success for the moment, I can't find any functions in the decompiled file. he bin file is for an ARM 32bits, I'm pretty sure this is an stm32, so ...
simon's user avatar
  • 131
0 votes
1 answer
177 views

Which tools are available to see embedded image and sound data

I'm reverse engineering a program from a memory dump using Ghidra. I know there are sections which contain images and sampled sound data in a raw format. I'm looking for a tool which will let me view ...
Robin Elvin's user avatar
2 votes
0 answers
44 views

How to get the APIs present in a particular block in a CFG using Angr?

I'm doing binary analysis based on Control Flow Graph (CFG). As I suppose to get the APIs from every block in the CFG. I'm finding it very difficult to do so using Angr as I don't have enough grip on ...
okokok hack's user avatar
1 vote
1 answer
43 views

How to know each register value instruction by instruction in a binary using radare2?

As I am using the radare2 for reverse engineering, I find it very difficult to get all the register values instruction by instruction with the help of the Radare2 tool. Could someone please help me to ...
okokok hack's user avatar
2 votes
0 answers
30 views

LZ4N file format - file decoding

I'm trying to decode a file that is part of device firmware. Unfortunately it comes RIFF<...>WAV format wrapped / packed with strange LZ4-like format. Non of linux available lz4 tools do ...
Krystian's user avatar
1 vote
0 answers
305 views

Firmware Binary Reverse with Ghidra returns only few codelines decompiled with truncated code

I have tried to decompile the firmware binary of a microcontroller that should be an STM32 (but I'm not sure about this). After the analysis I get only few codelines with a lot of similar messages: ...
AndreaF's user avatar
  • 111
0 votes
1 answer
96 views

Reversing encrypted file with unknown extension

Hello to everyone in RE section! I have a binary file with questionable extension(meaning idk if its exe/dll). Multiple variations of this file can be acquired throught connection to remote CDN via ...
Roman Avdeenko's user avatar
1 vote
1 answer
43 views

Under what circumstances relative to instr rip+offsets to .rdata data may not match?

I have a 100Mb binary file, in which I need to find and patch specific bytes in a function. When disassembled in IDA, this function is the only thing that ever references on unique ASCII string via ...
Digika's user avatar
  • 43
1 vote
0 answers
228 views

Reverse-engineering the Sony Camset (Camera Settings) file format

Context Newer Sony cameras have functionality that allows them to: save the current camera settings (shooting mode, auto-focus mode, etc.) to a file load the camera settings from a file into the ...
Raleigh L.'s user avatar
2 votes
0 answers
431 views

Find constant variables with float values using Ghidra

I dumped an il2cpp.so with il2cppDumper and in the dump.cs I found that the variables I wanted to change its values are somewhat constant float. this is the snippet: // Namespace: public class ...
hanan's user avatar
  • 239
1 vote
0 answers
70 views

jump to invalid address when emulating

I am currently working on a deobfuscation tool for a Windows Driver (which is obfuscated). I am using Capstone to disassemble and Unicorn to emulate. I have run into a weird issue where the indirect ...
Ayyware's user avatar
  • 21
0 votes
0 answers
411 views

Binwalk doesn't give results

I'm trying to reverse engineer a .bin file but binwalk doesn't give much information other than it says that there is a bitmap contained. The .bin file is 32 MB. Ghidra also doesn't input anything ...
Jonathan Gonzalez's user avatar
0 votes
0 answers
77 views

How exactly Hex editor is used?

I'm new to reverse engineering. So I decided to start with some game files in my computer. The main goal was to understand how hex editor used to identify files and extract needed data. In my case I ...
Namlind's user avatar
2 votes
1 answer
82 views

Need help decoding bytes to number

I've got a really really old file format from an accounting software, late '70s, DOS, QBasic or QuickBasic. Source code is lost, only .exe file remaining, file needs emulator. The file formate seems ...
JayC667's user avatar
  • 141
0 votes
1 answer
65 views

ida jumping to address I can't see in driver

When I open this driver in IDA i can't seem to see the instructions that this jmp at 0x1400DC46D jumps to. I've tried to undefine bytes and re-analyze the function but it then ends up will garbage. ...
Ayyware's user avatar
  • 21
1 vote
0 answers
4k views

Extracting ZTE F670L router's config.bin file

I want to enable telnet in my router (ZTE F670L V9.0.11P1N20D), So, I backup my router and i have a file config.bin, Size 23.5KB. I fired up kali and when i issue this command: $ file config.bin ...
Chirantan's user avatar
1 vote
1 answer
353 views

Ida cannot open. a files of esp32 (Xtensa)

I tried to open this file with IDA Pro https://github.com/espressif/esp32-wifi-lib/blob/master/esp32/libpp.a Ida detect that is ELF for Xtensa (relocatable) But when I tired to open it I got Undefined ...
Kokomelom's user avatar
  • 171
1 vote
2 answers
332 views

Changing the jne to je instruction causes program to generate error

I'm trying to change the instruction from jne to je I've change an instruction 75 0c jne [some_location] 75 0c is a 2 jump instruction. So, I've a chaged it to from 75 0c to 74 0c which is ...
user40683's user avatar
0 votes
1 answer
59 views

ROP: System function not printing results to stdout

in oder to solve a CTF-Challenge I have to construct a small ROP-chain. The scope of the ROP chain is to print the content of the `flag` file. I already constructed the ROP-chain, but it seems that ...
pekusbill's user avatar
2 votes
1 answer
65 views

Radare2 only printing out the last byte at RSP when using pxq @ rsp

According to documentation, px[?][owq] [len]    hexdump of N bytes (o=octal, w=32bit, q=64bit) and pr[?][glx] [len]    print N raw bytes (in lines or hexblocks, 'g'unzip) These two ...
user40683's user avatar
1 vote
0 answers
74 views

nrf52-based localization tag flash dump and modification

Lately I've bought a localisation tag (Apple AirTag alike). When I click a button on my cell phone, the device plays a chiptune-like ringtone. The ringtone is configurable using the app and stored on ...
tomaszu's user avatar
  • 11
0 votes
0 answers
249 views

ida shows instructions as hex data

I am new to reverse engineering. I did a couple of projects. now I was doing another project and faced kind of a problem. at the start of the program, there is a label that points to an address of ...
aiohioawhdoiwahdioawhioawhoiad's user avatar
1 vote
0 answers
96 views

Extracting Binary Stream inside an mp3

In the song Chisel by Pruient there seems to be what sounds like a binary octet stream starting at 4:43. The section of noise has distinct sections punctuated with momentary silence which leads me to ...
Gabriel Fair's user avatar
0 votes
1 answer
3k views

How to exploit __isoc99_scanf with a segmentation fault

I'm an absolute newbie when it comes to all this side of reverse engineering. Each time I try and understand it, I get lost almost immediately. I am trying a lab. I open it up in Binary Ninja. I get ...
pee2pee's user avatar
  • 221
2 votes
1 answer
819 views

How to call a func in an executable binary?

I have a binary with a func that I can disassemble. What are simple ways for me to call it with arbitrary args and observe its return val and behavior? Ideally, I'd like to do this: Within gdb (or ...
SRobertJames's user avatar
0 votes
0 answers
234 views

Reverse engineering STM32F303 firmware udpate

I have an .exe file, which connects via USB to a STM32F303 peripheral with unknown firmware. The .exe is able to update the STM32 firmware via the USB. The firmware update is also provided, and its ...
Slav's user avatar
  • 31
1 vote
1 answer
327 views

Binary diff + patching across versions

What are the current options for binary patching which works across different versions of the binary? E.g. we created a binary patch for a specific version of a binary and want to apply that patch to ...
MRalwasser's user avatar
3 votes
1 answer
222 views

What is data only exploitation?

I was wondering, and after trying to read for the past several months I got totally lost and don't understand this concept. Could someone please explain in simple words the concept of data only ...
one1one's user avatar
  • 31
2 votes
1 answer
108 views

When would a program normally transfer data between memory and coprocessor?

In the analysis of an ARM binary, when would one normally encounter transfer operations between memory and a coprocessor? These are encoded as the LDC and STC operators. Would it be common for ...
aug2uag's user avatar
  • 123
0 votes
0 answers
174 views

How do I view registers at a specific point of a binary's execution?

I have a binary that I'm attempting to reverse engineer to find a flag. From using ghidra I have found that the flag is stored in the program at a point called "check" and then run through ...
Jacob Pradels's user avatar
0 votes
0 answers
369 views

Extract smartwatch firmware bin file

I'm trying to extract files from a bin file that's the firmware of a smartwatch. I tried using binwalk -Mre firmware.bin but got no files, this is the result: How should I extract/modify this bin ...
Kazem Ma's user avatar
1 vote
2 answers
1k views

Can't figure out a crash in IDA "The memory could not be read -> 00000710 (exc.code c0000005, tid 20612)"

I'm trying to debug out a game. Basically, the Steam version works perfectly but the GOG version (which is 8kb smaller) has an annoying problem where for some people (which happen to be me) the game ...
TensionRising's user avatar
2 votes
1 answer
252 views

Proprietary 3D Format Reverse Engineering: What Could These Numbers And Matrices Represent?

I'm trying to reverse engineer a model format from an older Russian game (Pathologic) with limited success. It is a proprietary model format not recognized by any converters/editing tools (believe me, ...
Xtal44's user avatar
  • 21
0 votes
1 answer
71 views

string pointer to byte conversion condition

I am trying to understand the following snippet. I understand that the first check would check if it is even if it would be an int, but I don't understand it in this context. Could someone explain to ...
David's user avatar
  • 3

1
2 3 4 5
11