Questions tagged [binary-analysis]
The process of gathering information about a binary file, either with static or dynamic methods.
94
questions with no upvoted or accepted answers
8
votes
0
answers
812
views
Analyzing a Revit project file
I've been messing around with Revit and trying to understand the internal data structures for its file format. I'm not particularly experienced with this type of work and the processes around reverse ...
- 81
5
votes
1
answer
317
views
Are there existing automated approaches to reverse engineering the data types in a binary data stream?
Consider a stream of data packets of a known and consistent size, i.e., N bytes per packet.
Are there existing tools that automatically detect (or estimate) the various data types present and their ...
- 151
5
votes
0
answers
278
views
Radare2 8051 code bank switching
Some of 8051 chips use bank switching to extend accessible code memory.
Good example is Silabs C8051F12x. Another example is here.
Code area in range 0x0000..0x7ffff is common always accessible code ...
- 159
5
votes
0
answers
117
views
JTAG Dumped Flash is scrambled
I dumped the flash memory of an old ARM9 Chip running VxWorks using the SEGGER J-Link and the savebin command from J-Link Commander.
Here is an example of a line of HTML stored on memory.
<!DOC^...
- 51
5
votes
0
answers
867
views
How do I perform concolic execution with Angr and collect constraints on input?
I have a program that takes a string (with some structure) as input. My aim is to collect information on what values each character in input is compared to as it gets parsed using concolic execution. ...
- 151
4
votes
0
answers
104
views
How to assemble back a disassembled Linux kernel?
I have a Linux kernel file and I need to tweak the contents of its corresponding initramfs. I did it in the past for standard distros where kernel and initramfs were separate. However, this specific ...
- 141
3
votes
0
answers
128
views
How to analyze Dynamic import resolving malware?
How to analyze a runtime Dynamic import resolving malware? What are the best ways to do that kind of analysis?
Windows malware analysis.
3
votes
0
answers
65
views
PEStudio DLL analysis: flag in export section
I start to use PEStudio for DLL analysis; I understand (more or less) everything, except the "exports (flag)" section:
What does it mean the X in the flag column? So, what is a/the flag?
...
- 131
3
votes
0
answers
34
views
How can I quickly tell which ARM Thumb version a particular piece of code is using?
I'm working with an ARM processor: an STM32F407VGT6 board, which IIUC powers a 32-bit Arm® Cortex®-M4. I need to inspect the binary weight of some instruction, so I used objdump like this:
arm-none-...
3
votes
0
answers
372
views
Modify bin firmware file of an old phone
I am trying to remove/disable some system apps ( Messages, Games, Radio or Calendar ) and remove/replace the boot screen from samsung E1200y.
So i start searching for the way to do that...
I used HxH ...
- 53
3
votes
0
answers
1k
views
Reverse-engineering DOS game's data files
I would like to figure out the data format used by an old DOS game I used to play when I was a kid. That link includes a full download for all the files and it runs fine in DOSBox if you want to try ...
- 131
3
votes
0
answers
2k
views
Analysing eCos image
I'm working on unpacking a firmware image. I've already uncompressed the original image, but I'm stuck in the current step.
This is the current uncompressed image:
https://www.dropbox.com/s/...
- 31
3
votes
0
answers
431
views
How is the tp-link switch firmware obfuscated?
I was curious and wanted to learn a bit about TP-Link's switch firmware (for example: What OS are they using?). Because I have seen the sg3216 in the real world, I thought, I'd start with that one.
...
- 131
2
votes
0
answers
42
views
Please help identify which type of CPU architecture is used on obscure portable media players
I am trying to reverse engineer a media player with obscure SigmaTel SoCs just for fun but I didn't find very useful information.
As far as I don't know exactly what CPU architecture is used on these ...
- 21
2
votes
0
answers
56
views
Buffer overflow gets() weird parsing
I'm attempting to do a buffer overflow with gets(). I've figured out how to write over the return address and I'm able to do so, however, I cannot write in the address I need because the 0x7F at the ...
- 21
2
votes
0
answers
38
views
Find out what is this binary database entry and what format it is
the following varbinary "BUFFER" of a database entry is for an article.
FIELD_0 is in plain text and the item name is "1", which I created with the item management software.
[...
- 21
2
votes
0
answers
43
views
How to obtain import name from disassembled assembly
I'm trying to create my own tools for reverse engineering PE. I have some assembly codes that I fetched from a clone of objdump for a program. Sometimes I see call instructions such as :
callq *...
- 21
2
votes
0
answers
44
views
How to get the APIs present in a particular block in a CFG using Angr?
I'm doing binary analysis based on Control Flow Graph (CFG). As I suppose to get the APIs from every block in the CFG. I'm finding it very difficult to do so using Angr as I don't have enough grip on ...
- 39
2
votes
0
answers
30
views
LZ4N file format - file decoding
I'm trying to decode a file that is part of device firmware. Unfortunately it comes RIFF<...>WAV format wrapped / packed with strange LZ4-like format.
Non of linux available lz4 tools do ...
- 21
2
votes
0
answers
431
views
Find constant variables with float values using Ghidra
I dumped an il2cpp.so with il2cppDumper and in the dump.cs I found that the variables I wanted to change its values are somewhat constant float. this is the snippet:
// Namespace:
public class ...
- 239
2
votes
0
answers
583
views
Repacking vmlinux into zImage/bzimage
While RE an embedded device I ran into a problem - I need to patch a check in the kernel which has no sources available. Unpacking the kernel and binary-patching went smoothly. However I cannot get ...
- 163
2
votes
0
answers
228
views
Nokia 105(TA-1114) Firmware analysis using Binwalk
First please forgive me if a make any mistake. i am not a primarily English speaker but I will try my best.
Few days ago i started to tinkering with Nokia feature phone Nokia 105(TA-1114). I get a ...
2
votes
0
answers
139
views
How to modify checksum after making changes in Nokia 215 4G firmware?
If I change any character in the firmware file and try to flash it, it will failed. But it will successfully flashed if I changed the string with the same number of character if it's not a function.
...
- 21
2
votes
1
answer
67
views
The Logic Of Incremental Data on Serial Communication Encoding
These are the serial communication reverse values.
I am trying to understand the logic behind this.
I am pretty sure that 2 bytes represent 1 byte(high byte and low byte), values are correct.
I tried ...
2
votes
0
answers
148
views
Advice for retrieving functions and tables from Intel 8061/8065 bin file (reverse engineering) from Ford EECV ECU
I have under my disposal some Ford EECV bin files and my goal for the next few weeks is to retrieve the functions and tables, and plot them out before going onto DIY hardware.
Does anyone know which ...
- 21
2
votes
0
answers
183
views
submitting input into AFL fuzzer
I have some questions about the AFL Fuzzer:
How does the AFL Fuzzer know where to inject the payload in the code I compile? For instance if I want to inject it in a specific parameter, how do I do it?...
- 71
2
votes
0
answers
184
views
What's the pattern in this sequence extracted from a LYR document, used by the ESRI ArcGIS
I'm trying to reverse engineer a binary format, and I'm running up against a variable-length sequence of numbers which varies between files. I can't work out the pattern here and how to determine how ...
- 73
2
votes
0
answers
249
views
Google Maps, Android serialisation format
I've come across an SQLite database (gmm_storage.db) used by Google Maps on Android, and I'm unsure as to how the data it contains is serialised. For example:
I'm saying serialised, as from the ...
- 121
2
votes
0
answers
1k
views
Extracting firmware image from binary
I have firmware file in .bin format, but I need get firmware.img image file and Kernel uImage file for reflashing bricked device. How can I get these parts?
I used Binwalk to extract content, ...
- 215
2
votes
0
answers
125
views
Static analysis
I am working on a class project. I need to find out static features of a program (without executing it).
Backward branches (loops)
Conditional branches (potential threads with load imbalance)
...
- 121
2
votes
0
answers
66
views
How do I decode arbitrary data from a raw extracted binary?
I have a IoT scale that stores my measurements into records and passes them onto my phone. I was able to read directly off a flash chip and create a binary file. The chipset is ARMv7.
I want to be ...
2
votes
0
answers
367
views
What is the format of this binary file?
I have a binary file that I found on a 3D printer that is used to program a dsPIC30F5011 microcontroller. It is responsible for some basic data encryption. The only problem is, I am not sure how this ...
- 21
2
votes
0
answers
1k
views
IDA Pro user-defined offsets (again)
I'm disassembling a simple Z80 program and can't for the life of me work out how to - successfully - specify a user-defined offset.
I have a line of code as:
ld de, #0x6058
and FTR, this address ...
2
votes
0
answers
234
views
What is the difference between Software Architecture Recovery and Software Remodularization in the context of Reverse Engineering?
In the reverse engineering scenario, after extracting a representation of the code, it is often useful to recover/ reconstruct the architecture of the software (for eg. when reverse engineering java ...
- 201
1
vote
0
answers
23
views
How to reverse Engineer a Struct in IDA Pro?
How to identify and define a struct in IDA pro Decompiling during reverse engineering?
Please explain the easiest way to figure out the struct in IDA Pro decompilation!
To make life easier are there ...
1
vote
0
answers
114
views
Get all names of functions from an iOS-App binary (headless)
Setup:
I want to get a list of all (apple built-in) function and variable names that are used in an arbitrary iOS App by headless analysis. So given the .ipa file of any iOS-App, I unpack it and can ...
1
vote
0
answers
305
views
Firmware Binary Reverse with Ghidra returns only few codelines decompiled with truncated code
I have tried to decompile the firmware binary of a microcontroller that should be an STM32 (but I'm not sure about this).
After the analysis I get only few codelines with a lot of similar messages:
...
- 111
1
vote
0
answers
228
views
Reverse-engineering the Sony Camset (Camera Settings) file format
Context
Newer Sony cameras have functionality that allows them to:
save the current camera settings (shooting mode, auto-focus mode, etc.) to a file
load the camera settings from a file into the ...
- 131
1
vote
0
answers
70
views
jump to invalid address when emulating
I am currently working on a deobfuscation tool for a Windows Driver (which is obfuscated). I am using Capstone to disassemble and Unicorn to emulate. I have run into a weird issue where the indirect ...
- 21
1
vote
0
answers
4k
views
Extracting ZTE F670L router's config.bin file
I want to enable telnet in my router (ZTE F670L V9.0.11P1N20D), So, I backup my router and i have a file config.bin, Size 23.5KB. I fired up kali and when i issue this command:
$ file config.bin
...
- 11
1
vote
0
answers
74
views
nrf52-based localization tag flash dump and modification
Lately I've bought a localisation tag (Apple AirTag alike). When I click a button on my cell phone, the device plays a chiptune-like ringtone. The ringtone is configurable using the app and stored on ...
- 11
1
vote
0
answers
96
views
Extracting Binary Stream inside an mp3
In the song Chisel by Pruient there seems to be what sounds like a binary octet stream starting at 4:43.
The section of noise has distinct sections punctuated with momentary silence which leads me to ...
- 111
1
vote
0
answers
108
views
Unknown binary format (.scp) - No Header
I hope everyone is doing well. I've recently been trying to decode the structure of some files that contain a lot Unicode-8 IIRC characters, with a mix of binary. When I put it into IDA, I can't seem ...
- 11
1
vote
0
answers
55
views
How to find references for a string (where it is being called) in Go binary
I have a Go binary and I have this string:
When I go to its location, with IDA Pro, and tries to find all the references (using x) I am getting a message that there are no references:
It might be ...
- 573
1
vote
0
answers
129
views
What type of file has the file signature 'BOOT'?
I have a .bin file which I am trying to disassemble into something that I can edit. Given that binary files can contain just about any binary data, I found it difficult to assess what file data is ...
- 61
1
vote
0
answers
269
views
What is .data.rel.ro used for in GO on Linux?
I'm reversing a GO binary, and I was trying to locate where some symbols appear in the binary. I did the following:
Used nm on the binary - which did not recognize any symbols
Used go tool nm - same ...
- 1,770
1
vote
0
answers
41
views
PE Format - How can I delete IMAGE_IAT_DIRECTORY and the app still runs fine?
I’m doing a small research regarding PE files and while I drilled every related question or the documentation itself I couldn’t explain this issue.
Why can I go to CFF explorer or some other PE ...
- 133
1
vote
0
answers
229
views
What to do with a text file of disassembly code and binaries?
I am fairly new to software reverse engineering and I'd like to know how proceed with analyzing a program if I have a text file of disassembly code and a bin file of binary data. I understand ...
- 11
1
vote
0
answers
109
views
dwarf: variable offset from base
I have a simple code:
int main()
{
int a = 4;
printf("%d\n", a);
a = 8;
if (a == 8)
printf("%d\n", a);
return 0;
}
DIEs for the function and variable:
<1><32a>: Abbrev ...
- 1,707
1
vote
0
answers
55
views
Main contemporary deobfuscation techniques
Could you please specify in a few words main contemporary deobfuscation techniques which we can apply to 32/64 bit PE files?
For example, (1) using instruction templates, such as:
mov edx, 5B1F04F1h
...
- 131