Questions tagged [binary-analysis]

The process of gathering information about a binary file, either with static or dynamic methods.

94 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
8 votes
0 answers
812 views

Analyzing a Revit project file

I've been messing around with Revit and trying to understand the internal data structures for its file format. I'm not particularly experienced with this type of work and the processes around reverse ...
user25105's user avatar
5 votes
1 answer
317 views

Are there existing automated approaches to reverse engineering the data types in a binary data stream?

Consider a stream of data packets of a known and consistent size, i.e., N bytes per packet. Are there existing tools that automatically detect (or estimate) the various data types present and their ...
J. Tylka's user avatar
  • 151
5 votes
0 answers
278 views

Radare2 8051 code bank switching

Some of 8051 chips use bank switching to extend accessible code memory. Good example is Silabs C8051F12x. Another example is here. Code area in range 0x0000..0x7ffff is common always accessible code ...
kimstik's user avatar
  • 159
5 votes
0 answers
117 views

JTAG Dumped Flash is scrambled

I dumped the flash memory of an old ARM9 Chip running VxWorks using the SEGGER J-Link and the savebin command from J-Link Commander. Here is an example of a line of HTML stored on memory. <!DOC^...
user3547018's user avatar
5 votes
0 answers
867 views

How do I perform concolic execution with Angr and collect constraints on input?

I have a program that takes a string (with some structure) as input. My aim is to collect information on what values each character in input is compared to as it gets parsed using concolic execution. ...
Rahul Gopinath's user avatar
4 votes
0 answers
104 views

How to assemble back a disassembled Linux kernel?

I have a Linux kernel file and I need to tweak the contents of its corresponding initramfs. I did it in the past for standard distros where kernel and initramfs were separate. However, this specific ...
Peter's user avatar
  • 141
3 votes
0 answers
128 views

How to analyze Dynamic import resolving malware?

How to analyze a runtime Dynamic import resolving malware? What are the best ways to do that kind of analysis? Windows malware analysis.
Jose I. Hughes's user avatar
3 votes
0 answers
65 views

PEStudio DLL analysis: flag in export section

I start to use PEStudio for DLL analysis; I understand (more or less) everything, except the "exports (flag)" section: What does it mean the X in the flag column? So, what is a/the flag? ...
Gianluca's user avatar
  • 131
3 votes
0 answers
34 views

How can I quickly tell which ARM Thumb version a particular piece of code is using?

I'm working with an ARM processor: an STM32F407VGT6 board, which IIUC powers a 32-bit Arm® Cortex®-M4. I need to inspect the binary weight of some instruction, so I used objdump like this: arm-none-...
Alessandro Bertulli's user avatar
3 votes
0 answers
372 views

Modify bin firmware file of an old phone

I am trying to remove/disable some system apps ( Messages, Games, Radio or Calendar ) and remove/replace the boot screen from samsung E1200y. So i start searching for the way to do that... I used HxH ...
M J's user avatar
  • 53
3 votes
0 answers
1k views

Reverse-engineering DOS game's data files

I would like to figure out the data format used by an old DOS game I used to play when I was a kid. That link includes a full download for all the files and it runs fine in DOSBox if you want to try ...
André Borie's user avatar
3 votes
0 answers
2k views

Analysing eCos image

I'm working on unpacking a firmware image. I've already uncompressed the original image, but I'm stuck in the current step. This is the current uncompressed image: https://www.dropbox.com/s/...
tnas's user avatar
  • 31
3 votes
0 answers
431 views

How is the tp-link switch firmware obfuscated?

I was curious and wanted to learn a bit about TP-Link's switch firmware (for example: What OS are they using?). Because I have seen the sg3216 in the real world, I thought, I'd start with that one. ...
Elrond's user avatar
  • 131
2 votes
0 answers
42 views

Please help identify which type of CPU architecture is used on obscure portable media players

I am trying to reverse engineer a media player with obscure SigmaTel SoCs just for fun but I didn't find very useful information. As far as I don't know exactly what CPU architecture is used on these ...
Andy's user avatar
  • 21
2 votes
0 answers
56 views

Buffer overflow gets() weird parsing

I'm attempting to do a buffer overflow with gets(). I've figured out how to write over the return address and I'm able to do so, however, I cannot write in the address I need because the 0x7F at the ...
user42774's user avatar
2 votes
0 answers
38 views

Find out what is this binary database entry and what format it is

the following varbinary "BUFFER" of a database entry is for an article. FIELD_0 is in plain text and the item name is "1", which I created with the item management software. [...
Chrischi's user avatar
2 votes
0 answers
43 views

How to obtain import name from disassembled assembly

I'm trying to create my own tools for reverse engineering PE. I have some assembly codes that I fetched from a clone of objdump for a program. Sometimes I see call instructions such as : callq *...
onerom's user avatar
  • 21
2 votes
0 answers
44 views

How to get the APIs present in a particular block in a CFG using Angr?

I'm doing binary analysis based on Control Flow Graph (CFG). As I suppose to get the APIs from every block in the CFG. I'm finding it very difficult to do so using Angr as I don't have enough grip on ...
okokok hack's user avatar
2 votes
0 answers
30 views

LZ4N file format - file decoding

I'm trying to decode a file that is part of device firmware. Unfortunately it comes RIFF<...>WAV format wrapped / packed with strange LZ4-like format. Non of linux available lz4 tools do ...
Krystian's user avatar
2 votes
0 answers
431 views

Find constant variables with float values using Ghidra

I dumped an il2cpp.so with il2cppDumper and in the dump.cs I found that the variables I wanted to change its values are somewhat constant float. this is the snippet: // Namespace: public class ...
hanan's user avatar
  • 239
2 votes
0 answers
583 views

Repacking vmlinux into zImage/bzimage

While RE an embedded device I ran into a problem - I need to patch a check in the kernel which has no sources available. Unpacking the kernel and binary-patching went smoothly. However I cannot get ...
kiler129's user avatar
  • 163
2 votes
0 answers
228 views

Nokia 105(TA-1114) Firmware analysis using Binwalk

First please forgive me if a make any mistake. i am not a primarily English speaker but I will try my best. Few days ago i started to tinkering with Nokia feature phone Nokia 105(TA-1114). I get a ...
muhammad shahzaib's user avatar
2 votes
0 answers
139 views

How to modify checksum after making changes in Nokia 215 4G firmware?

If I change any character in the firmware file and try to flash it, it will failed. But it will successfully flashed if I changed the string with the same number of character if it's not a function. ...
Mohamed's user avatar
  • 21
2 votes
1 answer
67 views

The Logic Of Incremental Data on Serial Communication Encoding

These are the serial communication reverse values. I am trying to understand the logic behind this. I am pretty sure that 2 bytes represent 1 byte(high byte and low byte), values are correct. I tried ...
ömer faruk Cebir's user avatar
2 votes
0 answers
148 views

Advice for retrieving functions and tables from Intel 8061/8065 bin file (reverse engineering) from Ford EECV ECU

I have under my disposal some Ford EECV bin files and my goal for the next few weeks is to retrieve the functions and tables, and plot them out before going onto DIY hardware. Does anyone know which ...
Jt90's user avatar
  • 21
2 votes
0 answers
183 views

submitting input into AFL fuzzer

I have some questions about the AFL Fuzzer: How does the AFL Fuzzer know where to inject the payload in the code I compile? For instance if I want to inject it in a specific parameter, how do I do it?...
Logan's user avatar
  • 71
2 votes
0 answers
184 views

What's the pattern in this sequence extracted from a LYR document, used by the ESRI ArcGIS

I'm trying to reverse engineer a binary format, and I'm running up against a variable-length sequence of numbers which varies between files. I can't work out the pattern here and how to determine how ...
ndawson's user avatar
  • 73
2 votes
0 answers
249 views

Google Maps, Android serialisation format

I've come across an SQLite database (gmm_storage.db) used by Google Maps on Android, and I'm unsure as to how the data it contains is serialised. For example: I'm saying serialised, as from the ...
Tony's user avatar
  • 121
2 votes
0 answers
1k views

Extracting firmware image from binary

I have firmware file in .bin format, but I need get firmware.img image file and Kernel uImage file for reflashing bricked device. How can I get these parts? I used Binwalk to extract content, ...
minto's user avatar
  • 215
2 votes
0 answers
125 views

Static analysis

I am working on a class project. I need to find out static features of a program (without executing it). Backward branches (loops) Conditional branches (potential threads with load imbalance) ...
Tulsi's user avatar
  • 121
2 votes
0 answers
66 views

How do I decode arbitrary data from a raw extracted binary?

I have a IoT scale that stores my measurements into records and passes them onto my phone. I was able to read directly off a flash chip and create a binary file. The chipset is ARMv7. I want to be ...
ArtificialAmateur's user avatar
2 votes
0 answers
367 views

What is the format of this binary file?

I have a binary file that I found on a 3D printer that is used to program a dsPIC30F5011 microcontroller. It is responsible for some basic data encryption. The only problem is, I am not sure how this ...
user3397540's user avatar
2 votes
0 answers
1k views

IDA Pro user-defined offsets (again)

I'm disassembling a simple Z80 program and can't for the life of me work out how to - successfully - specify a user-defined offset. I have a line of code as: ld de, #0x6058 and FTR, this address ...
Mark McDougall's user avatar
2 votes
0 answers
234 views

What is the difference between Software Architecture Recovery and Software Remodularization in the context of Reverse Engineering?

In the reverse engineering scenario, after extracting a representation of the code, it is often useful to recover/ reconstruct the architecture of the software (for eg. when reverse engineering java ...
Annamalai N's user avatar
1 vote
0 answers
23 views

How to reverse Engineer a Struct in IDA Pro?

How to identify and define a struct in IDA pro Decompiling during reverse engineering? Please explain the easiest way to figure out the struct in IDA Pro decompilation! To make life easier are there ...
Jose I. Hughes's user avatar
1 vote
0 answers
114 views

Get all names of functions from an iOS-App binary (headless)

Setup: I want to get a list of all (apple built-in) function and variable names that are used in an arbitrary iOS App by headless analysis. So given the .ipa file of any iOS-App, I unpack it and can ...
Kühlhausvogel's user avatar
1 vote
0 answers
305 views

Firmware Binary Reverse with Ghidra returns only few codelines decompiled with truncated code

I have tried to decompile the firmware binary of a microcontroller that should be an STM32 (but I'm not sure about this). After the analysis I get only few codelines with a lot of similar messages: ...
AndreaF's user avatar
  • 111
1 vote
0 answers
228 views

Reverse-engineering the Sony Camset (Camera Settings) file format

Context Newer Sony cameras have functionality that allows them to: save the current camera settings (shooting mode, auto-focus mode, etc.) to a file load the camera settings from a file into the ...
Raleigh L.'s user avatar
1 vote
0 answers
70 views

jump to invalid address when emulating

I am currently working on a deobfuscation tool for a Windows Driver (which is obfuscated). I am using Capstone to disassemble and Unicorn to emulate. I have run into a weird issue where the indirect ...
Ayyware's user avatar
  • 21
1 vote
0 answers
4k views

Extracting ZTE F670L router's config.bin file

I want to enable telnet in my router (ZTE F670L V9.0.11P1N20D), So, I backup my router and i have a file config.bin, Size 23.5KB. I fired up kali and when i issue this command: $ file config.bin ...
Chirantan's user avatar
1 vote
0 answers
74 views

nrf52-based localization tag flash dump and modification

Lately I've bought a localisation tag (Apple AirTag alike). When I click a button on my cell phone, the device plays a chiptune-like ringtone. The ringtone is configurable using the app and stored on ...
tomaszu's user avatar
  • 11
1 vote
0 answers
96 views

Extracting Binary Stream inside an mp3

In the song Chisel by Pruient there seems to be what sounds like a binary octet stream starting at 4:43. The section of noise has distinct sections punctuated with momentary silence which leads me to ...
Gabriel Fair's user avatar
1 vote
0 answers
108 views

Unknown binary format (.scp) - No Header

I hope everyone is doing well. I've recently been trying to decode the structure of some files that contain a lot Unicode-8 IIRC characters, with a mix of binary. When I put it into IDA, I can't seem ...
Kevin's user avatar
  • 11
1 vote
0 answers
55 views

How to find references for a string (where it is being called) in Go binary

I have a Go binary and I have this string: When I go to its location, with IDA Pro, and tries to find all the references (using x) I am getting a message that there are no references: It might be ...
E235's user avatar
  • 573
1 vote
0 answers
129 views

What type of file has the file signature 'BOOT'?

I have a .bin file which I am trying to disassemble into something that I can edit. Given that binary files can contain just about any binary data, I found it difficult to assess what file data is ...
Xiddoc's user avatar
  • 61
1 vote
0 answers
269 views

What is .data.rel.ro used for in GO on Linux?

I'm reversing a GO binary, and I was trying to locate where some symbols appear in the binary. I did the following: Used nm on the binary - which did not recognize any symbols Used go tool nm - same ...
the_endian's user avatar
  • 1,770
1 vote
0 answers
41 views

PE Format - How can I delete IMAGE_IAT_DIRECTORY and the app still runs fine?

I’m doing a small research regarding PE files and while I drilled every related question or the documentation itself I couldn’t explain this issue. Why can I go to CFF explorer or some other PE ...
FigureItOut's user avatar
1 vote
0 answers
229 views

What to do with a text file of disassembly code and binaries?

I am fairly new to software reverse engineering and I'd like to know how proceed with analyzing a program if I have a text file of disassembly code and a bin file of binary data. I understand ...
DylanG1991's user avatar
1 vote
0 answers
109 views

dwarf: variable offset from base

I have a simple code: int main() { int a = 4; printf("%d\n", a); a = 8; if (a == 8) printf("%d\n", a); return 0; } DIEs for the function and variable: <1><32a>: Abbrev ...
R4444's user avatar
  • 1,707
1 vote
0 answers
55 views

Main contemporary deobfuscation techniques

Could you please specify in a few words main contemporary deobfuscation techniques which we can apply to 32/64 bit PE files? For example, (1) using instruction templates, such as: mov edx, 5B1F04F1h ...
DBenson's user avatar
  • 131