Questions tagged [binary-analysis]
The process of gathering information about a binary file, either with static or dynamic methods.
122
questions with no upvoted or accepted answers
8
votes
0
answers
958
views
Analyzing a Revit project file
I've been messing around with Revit and trying to understand the internal data structures for its file format. I'm not particularly experienced with this type of work and the processes around reverse ...
- 81
5
votes
1
answer
437
views
Are there existing automated approaches to reverse engineering the data types in a binary data stream?
Consider a stream of data packets of a known and consistent size, i.e., N bytes per packet.
Are there existing tools that automatically detect (or estimate) the various data types present and their ...
- 151
5
votes
0
answers
343
views
Radare2 8051 code bank switching
Some of 8051 chips use bank switching to extend accessible code memory.
Good example is Silabs C8051F12x. Another example is here.
Code area in range 0x0000..0x7ffff is common always accessible code ...
- 159
5
votes
0
answers
142
views
JTAG Dumped Flash is scrambled
I dumped the flash memory of an old ARM9 Chip running VxWorks using the SEGGER J-Link and the savebin command from J-Link Commander.
Here is an example of a line of HTML stored on memory.
<!DOC^...
- 51
5
votes
0
answers
1k
views
How do I perform concolic execution with Angr and collect constraints on input?
I have a program that takes a string (with some structure) as input. My aim is to collect information on what values each character in input is compared to as it gets parsed using concolic execution. ...
- 151
4
votes
0
answers
220
views
How to assemble back a disassembled Linux kernel?
I have a Linux kernel file and I need to tweak the contents of its corresponding initramfs. I did it in the past for standard distros where kernel and initramfs were separate. However, this specific ...
- 141
3
votes
0
answers
251
views
PEStudio DLL analysis: flag in export section
I start to use PEStudio for DLL analysis; I understand (more or less) everything, except the "exports (flag)" section:
What does it mean the X in the flag column? So, what is a/the flag?
...
- 131
3
votes
0
answers
74
views
How can I quickly tell which ARM Thumb version a particular piece of code is using?
I'm working with an ARM processor: an STM32F407VGT6 board, which IIUC powers a 32-bit Arm® Cortex®-M4. I need to inspect the binary weight of some instruction, so I used objdump like this:
arm-none-...
3
votes
0
answers
575
views
Reverse-engineering the Sony Camset (Camera Settings) file format
Context
Newer Sony cameras have functionality that allows them to:
save the current camera settings (shooting mode, auto-focus mode, etc.) to a file
load the camera settings from a file into the ...
- 161
3
votes
0
answers
1k
views
Find constant variables with float values using Ghidra
I dumped an il2cpp.so with il2cppDumper and in the dump.cs I found that the variables I wanted to change its values are somewhat constant float. this is the snippet:
// Namespace:
public class ...
- 309
3
votes
0
answers
530
views
Modify bin firmware file of an old phone
I am trying to remove/disable some system apps ( Messages, Games, Radio or Calendar ) and remove/replace the boot screen from samsung E1200y.
So i start searching for the way to do that...
I used HxH ...
- 53
3
votes
0
answers
1k
views
Reverse-engineering DOS game's data files
I would like to figure out the data format used by an old DOS game I used to play when I was a kid. That link includes a full download for all the files and it runs fine in DOSBox if you want to try ...
- 131
3
votes
0
answers
2k
views
Analysing eCos image
I'm working on unpacking a firmware image. I've already uncompressed the original image, but I'm stuck in the current step.
This is the current uncompressed image:
https://www.dropbox.com/s/...
- 31
3
votes
0
answers
446
views
How is the tp-link switch firmware obfuscated?
I was curious and wanted to learn a bit about TP-Link's switch firmware (for example: What OS are they using?). Because I have seen the sg3216 in the real world, I thought, I'd start with that one.
...
- 131
2
votes
0
answers
660
views
Please help identify which type of CPU architecture is used on obscure portable media players
I am trying to reverse engineer a media player with obscure SigmaTel SoCs just for fun but I didn't find very useful information.
As far as I don't know exactly what CPU architecture is used on these ...
- 21
2
votes
0
answers
68
views
Buffer overflow gets() weird parsing
I'm attempting to do a buffer overflow with gets(). I've figured out how to write over the return address and I'm able to do so, however, I cannot write in the address I need because the 0x7F at the ...
- 21
2
votes
0
answers
40
views
Find out what is this binary database entry and what format it is
the following varbinary "BUFFER" of a database entry is for an article.
FIELD_0 is in plain text and the item name is "1", which I created with the item management software.
[...
- 21
2
votes
0
answers
58
views
How to obtain import name from disassembled assembly
I'm trying to create my own tools for reverse engineering PE. I have some assembly codes that I fetched from a clone of objdump for a program. Sometimes I see call instructions such as :
callq *...
- 21
2
votes
0
answers
47
views
How to get the APIs present in a particular block in a CFG using Angr?
I'm doing binary analysis based on Control Flow Graph (CFG). As I suppose to get the APIs from every block in the CFG. I'm finding it very difficult to do so using Angr as I don't have enough grip on ...
- 39
2
votes
0
answers
49
views
LZ4N file format - file decoding
I'm trying to decode a file that is part of device firmware. Unfortunately it comes RIFF<...>WAV format wrapped / packed with strange LZ4-like format.
Non of linux available lz4 tools do ...
- 21
2
votes
0
answers
773
views
Firmware Binary Reverse with Ghidra returns only few codelines decompiled with truncated code
I have tried to decompile the firmware binary of a microcontroller that should be an STM32 (but I'm not sure about this).
After the analysis I get only few codelines with a lot of similar messages:
...
- 121
2
votes
0
answers
87
views
jump to invalid address when emulating
I am currently working on a deobfuscation tool for a Windows Driver (which is obfuscated). I am using Capstone to disassemble and Unicorn to emulate. I have run into a weird issue where the indirect ...
- 41
2
votes
0
answers
8k
views
Extracting ZTE F670L router's config.bin file
I want to enable telnet in my router (ZTE F670L V9.0.11P1N20D), So, I backup my router and i have a file config.bin, Size 23.5KB. I fired up kali and when i issue this command:
$ file config.bin
...
- 21
2
votes
0
answers
103
views
nrf52-based localization tag flash dump and modification
Lately I've bought a localisation tag (Apple AirTag alike). When I click a button on my cell phone, the device plays a chiptune-like ringtone. The ringtone is configurable using the app and stored on ...
- 21
2
votes
0
answers
1k
views
Repacking vmlinux into zImage/bzimage
While RE an embedded device I ran into a problem - I need to patch a check in the kernel which has no sources available. Unpacking the kernel and binary-patching went smoothly. However I cannot get ...
- 163
2
votes
0
answers
487
views
Nokia 105(TA-1114) Firmware analysis using Binwalk
First please forgive me if a make any mistake. i am not a primarily English speaker but I will try my best.
Few days ago i started to tinkering with Nokia feature phone Nokia 105(TA-1114). I get a ...
2
votes
0
answers
183
views
How to modify checksum after making changes in Nokia 215 4G firmware?
If I change any character in the firmware file and try to flash it, it will failed. But it will successfully flashed if I changed the string with the same number of character if it's not a function.
...
- 21
2
votes
1
answer
100
views
The Logic Of Incremental Data on Serial Communication Encoding
These are the serial communication reverse values.
I am trying to understand the logic behind this.
I am pretty sure that 2 bytes represent 1 byte(high byte and low byte), values are correct.
I tried ...
2
votes
0
answers
190
views
Advice for retrieving functions and tables from Intel 8061/8065 bin file (reverse engineering) from Ford EECV ECU
I have under my disposal some Ford EECV bin files and my goal for the next few weeks is to retrieve the functions and tables, and plot them out before going onto DIY hardware.
Does anyone know which ...
- 21
2
votes
0
answers
202
views
submitting input into AFL fuzzer
I have some questions about the AFL Fuzzer:
How does the AFL Fuzzer know where to inject the payload in the code I compile? For instance if I want to inject it in a specific parameter, how do I do it?...
- 71
2
votes
0
answers
187
views
What's the pattern in this sequence extracted from a LYR document, used by the ESRI ArcGIS
I'm trying to reverse engineer a binary format, and I'm running up against a variable-length sequence of numbers which varies between files. I can't work out the pattern here and how to determine how ...
- 73
2
votes
0
answers
336
views
Google Maps, Android serialisation format
I've come across an SQLite database (gmm_storage.db) used by Google Maps on Android, and I'm unsure as to how the data it contains is serialised. For example:
I'm saying serialised, as from the ...
- 133
2
votes
0
answers
1k
views
Extracting firmware image from binary
I have firmware file in .bin format, but I need get firmware.img image file and Kernel uImage file for reflashing bricked device. How can I get these parts?
I used Binwalk to extract content, ...
- 235
2
votes
0
answers
126
views
Static analysis
I am working on a class project. I need to find out static features of a program (without executing it).
Backward branches (loops)
Conditional branches (potential threads with load imbalance)
...
- 121
2
votes
0
answers
109
views
How do I decode arbitrary data from a raw extracted binary?
I have a IoT scale that stores my measurements into records and passes them onto my phone. I was able to read directly off a flash chip and create a binary file. The chipset is ARMv7.
I want to be ...
2
votes
0
answers
380
views
What is the format of this binary file?
I have a binary file that I found on a 3D printer that is used to program a dsPIC30F5011 microcontroller. It is responsible for some basic data encryption. The only problem is, I am not sure how this ...
- 21
2
votes
0
answers
906
views
How can I find loading adress of eCos image
Hey guys Im trying to find loading address (entry point of my program) for this binary, which is part off this firmware. Im trying to load it inside of IDA, how can I correctly load it, how to find ...
- 515
2
votes
0
answers
1k
views
IDA Pro user-defined offsets (again)
I'm disassembling a simple Z80 program and can't for the life of me work out how to - successfully - specify a user-defined offset.
I have a line of code as:
ld de, #0x6058
and FTR, this address ...
2
votes
0
answers
239
views
What is the difference between Software Architecture Recovery and Software Remodularization in the context of Reverse Engineering?
In the reverse engineering scenario, after extracting a representation of the code, it is often useful to recover/ reconstruct the architecture of the software (for eg. when reverse engineering java ...
- 201
1
vote
1
answer
75
views
Static offsets Vs. Loaded Offsets
I am developing an application integrity concept tool that performs integrity checks based on a comparison of Windows syscalls in a static PE file on disk to those loaded. Can I match the offset of ...
- 11
1
vote
0
answers
43
views
Potential vulnerabilities in a binary run as root
I am given a vulnerable 64-bit stripped application, it conducts basic password strength checks on linux(/etc/shadow). The application receives workers(which creates worker process for performing the ...
- 111
1
vote
1
answer
178
views
VxWorks flat binary file
VxWorks has a "flat binary file" format in which the initial 8 byte values are 45 53 54 46 42 49 4E 52 (ESTFBINR if interpreted as ASCII).
I know very little about their content except:
...
- 31
1
vote
0
answers
166
views
Analyse a statically linked binary and extract syscall from it using angr
How to extract all syscalls from analysing a statically linked binary.
I have a script written using angr(Latest - v9.2.78) but when I start my script I get few syscalls and the analysis is like hung ...
- 11
1
vote
0
answers
41
views
Old Windows CE 5.0 device image repair
I need to repair an old industrial device, based on Intel XScale PXA255 and Windows CE 5.0. It has a bootloader on NOR Flash and OS image and filesystem partitions on NAND. I've disassembled ...
- 11
1
vote
0
answers
46
views
Retrieve functionality to button - game patching
I'm patching an old game, and I want the retrieve the toggle fullscreen functionality it's supposed to have.
In the menu, in the display tab, there is a disabled option of fullscreen mode that you can ...
- 21
1
vote
0
answers
104
views
angr - project.loader.find_symbol("main") does not works
I have very simple C code - compiled on MSVC using clang++ compiler. When I am running it under angr environment - it simply does not finds main() function, while it can do so for other things like ...
- 121
1
vote
0
answers
243
views
Get all names of functions from an iOS-App binary (headless)
Setup:
I want to get a list of all (apple built-in) function and variable names that are used in an arbitrary iOS App by headless analysis. So given the .ipa file of any iOS-App, I unpack it and can ...
1
vote
1
answer
762
views
Reverse Engineering Go obfuscated binaries
I have been trying to understand the working of this go malware by reversing it, which can be found here , so basically this stuff takes a shellcode as an input, and converts it to an exe or dll file, ...
- 11
1
vote
0
answers
94
views
How exactly Hex editor is used?
I'm new to reverse engineering. So I decided to start with some game files in my computer. The main goal was to understand how hex editor used to identify files and extract needed data.
In my case I ...
- 11
1
vote
0
answers
403
views
ida shows instructions as hex data
I am new to reverse engineering. I did a couple of projects. now I was doing another project and faced kind of a problem.
at the start of the program, there is a label that points to an address of ...
