Questions tagged [binary-analysis]

The process of gathering information about a binary file, either with static or dynamic methods.

Filter by
Sorted by
Tagged with
0
votes
1answer
2k views

Dumping the GOT with gdb at run time

I want to see how the plt stubs are being resolved at run time when lazy linking is used and how the GOT is changed along the way. How can I dump the GOT with gdb?
2
votes
1answer
85 views

Is there a standard documentation format for file formats?

I'm analysing an undocumented file format. Is there a standard documentation format for file formats I can write up? Something of this level of complexity and detail? What I have in my mind is, !...
1
vote
0answers
18 views

Locating Exit/Abort Functions from Static Analysis

Similar to this question, I'm interested in locating exit and abort style functions in a firmware - any function call that in fact terminates the execution, by statically analyzing the firmware. My ...
1
vote
1answer
781 views

Extracting functions of .obj file (compiled by myself with Visual Studio 19) --> extracts wrong data

How can I find only real functions not data garbage like section..debug_S_105 ? * I need to collect function data (assembler code) of Open Source C++ Files which I compile with Visual Studio 19 (sln ...
0
votes
0answers
298 views

reversing xiaomi update firmware encrypted?

I am playing around with a xiaomi firmware [mijia_4k_0.6.16.02] for a camera Running binwalk on the file I see this output DECIMAL HEXADECIMAL DESCRIPTION ----------------------------------...
1
vote
1answer
163 views

empty .data section in AARCH64 elf binaries

My question is: Why does readelf -x .data bin.so give me empty data when ghidra does not? (0x00 repeated for section length until last element 0xFFFFFFFF). ghidra/JEB contradict me by showing that ...
0
votes
0answers
112 views

Tools for statistical analysis of binary streams

I'm in the process of decoding the semantics of an unknown binary stream1. I've come to a point where I understand the overall structure: A tag byte, followed by a size field, and a blob of bytes of ...
1
vote
1answer
421 views

Reversing a key-gen firmware for RISC-V

I would like to study this firmware for Sipeed MAix, a RISC-V development board. You can download it here: key_gen_v1.2.zip. As the name suggests, its purpose is to calculate and print a "machine key"...
4
votes
0answers
661 views

How do I perform concolic execution with Angr and collect constraints on input?

I have a program that takes a string (with some structure) as input. My aim is to collect information on what values each character in input is compared to as it gets parsed using concolic execution. ...
1
vote
0answers
238 views

Extract files of a SquashFS Filesystem

I already asked a similar question but after a deeper analysis of the filesystem I found out that I misunderstood the problem and that's why I decided to delete the old question and make a new one. I ...
0
votes
1answer
129 views

Is it possible to extract the binary firmware of a feature phone? [closed]

I am new at reverse engineering but very eager to learn. I have a feature phone it5081 and downloaded it's binary firmware. I have googled and came to know about tools like binwalk,firmware mod kit as ...
2
votes
2answers
385 views

Prevent Memory Inspection in a Cython program?

Cython is a great way to protect the source code of a Python program. However, memory inspection and memory reverse engineering can still be done to this Cython program. What are ways to prevent (or ...
3
votes
1answer
143 views

Importance of learning file structures for reverse engineering?

I'm new to reverse engineering and I have started to study the anatomy of specific file formats, specifically PE right now. I really enjoy learning the different parts of the files and the different ...
10
votes
2answers
6k views

How to load symbols from a symbol server in Ghidra?

I've been trying to learn Ghidra by attempting to reverse the comctl32.dll system library, which has many of its functions documented. I started the de-compilation analysis in it, and after a while it ...
0
votes
1answer
167 views

CISC/RISC in reverse engineering

What is the difference between CISC/RISC when reverse engineering a binary? I know the difference between them, but is there any difference while reversing? Is it easier to reverse CISC than RISC?
1
vote
1answer
103 views

Which JSON object compact binary serialization is this?

I am trying to reverse engineer an unknown JSON binary serialization format found in a request-response pair between a mobile app, and a server. Does anyone recognize this? I've attached the first ...
1
vote
1answer
331 views

Unknown Game Client Data

As asking a friend and no amount of Googling yielded an answer, I figured I'd make an account and give this place a go. I'm working on reverse engineering the server for a relatively old game with no ...
2
votes
1answer
98 views

Finding "func main" in a stripped binary written in GO

I'm reversing a binary that was apart of a CTF I was involved in about a month ago. It was too large of a binary to do during the challenge so I am doing it now. I am having trouble finding the main ...
4
votes
2answers
257 views

What are the popular machine learning unsupervised approaches to learning binary data representations?

This is somewhat open-ended question, so bear with me please. Be it a binary payload that you pull from network packet, firmware blob you pull of some EPROM or data intercepted straight from physical ...
2
votes
0answers
147 views

submitting input into AFL fuzzer

I have some questions about the AFL Fuzzer: How does the AFL Fuzzer know where to inject the payload in the code I compile? For instance if I want to inject it in a specific parameter, how do I do it?...
0
votes
0answers
201 views

How can I find loading adress of eCos firmware

From:https://www.tendacn.com/en/download/detail-3482.html Im trying to find loading address (entry point of my program) for this binary, which is part off this firmware. Im trying to load it inside ...
1
vote
2answers
2k views

binwalk on reversing switch firmware

everyone. I am a green apple in reversing. Recently i wanna reverse a switch but get some problems. i reaaaaaaaaly need your guys help. first i extract the .bin file from the switch and use binwalk ...
7
votes
2answers
18k views

What's the difference between a disassembler, debugger and decompiler?

I have heard of disassemblers like IDA and debuggers like OllyDbg but honestly, when you give both of them a binary file it gives me the assembly code. I know that the decompiler gives the source code ...
1
vote
3answers
437 views

What is the difference between malware that is 'dumped' and one that is 'unpacked'?

On malware sharing communities, I have been noticing that the samples shared are marked as unpacked or dumped. I have tried to load the dumped malware in IDAFree, however, there is nothing in the ...
1
vote
1answer
175 views

Deciphering an unknown graphics format

For my own amusement, I dumped the files of an old Nintendo DS video game I have (the company has long since gone bankrupt/closed) and am trying to extract the assets. I have recovered game text, ...
0
votes
0answers
85 views

Is there a way to see 'imports' in a .NET binary?

Programs such as Detect It Easy or IDA can show functions and libraries (DLLs) imported by a binary in the case of C/C++ binaries. I have a collection of .NET malware that I'm analyzing and would like ...
2
votes
2answers
274 views

gdb shows that EBP contains a value other than some address(which is what it is supposed to contain). How is this possible?

I am fairly new to RE and Binary Exploitation, I have learned basic assembly instructions for Binary Exploitation and I was doing Protostar exercises (stack0) in which I have to simply overflow the ...
0
votes
1answer
144 views

x64dbgpy: application unresponsive when trying to automate inside breakpoint callback

When a breakpoint callback is triggered trying to automate the debugger inside the callback causes the application to become unresponsive. x64dbg continues functioning but the application itself doesn'...
2
votes
0answers
181 views

What's the pattern in this sequence extracted from a LYR document, used by the ESRI ArcGIS

I'm trying to reverse engineer a binary format, and I'm running up against a variable-length sequence of numbers which varies between files. I can't work out the pattern here and how to determine how ...
6
votes
3answers
6k views

unpack Clear spot .bin firmware update

I am trying to unpack a clear spot firmware update The firmware I am trying to reverse can be found on the download page of the vendor I have used the fwtools to unpack the firmware as described on ...
2
votes
1answer
184 views

Unknown archive format from QNX operating system

We are reverse engineering a QNX system and we have found a small file that is uploaded to the system. It appears to be either a file system image or an uncompressed archive of some sort. We can't ...
2
votes
1answer
260 views

How can I determine a module to which function is related with IDA Pro

For example I have a function sub_7FFA95D8F120. I've checked out Views->Segments which shows .text segment. It seems that I am missing out something important. It would be great if someone explained ...
0
votes
1answer
64 views

Easy way to understand vulnerable functions while Reversing [closed]

I have been doing reversing lately and not an experienced Reverse engineer. Mostly I do audit on binaries both fuzzing and source code. As I am new to this stuff, I am getting some issues of ...
0
votes
1answer
3k views

Binwalk to Extract Firmware is not working for me

I'm trying to extract code from Yuneec Drone Firmware and I've run into some issues. Currently when I run binwalk agains the file, I get the following issues: binwalk autopilot.yuneec.bin DECIMAL ...
0
votes
1answer
88 views

What is the best approach for using IDA's remote debugger for analyzing a sample with two VMs?

Sorry if this is a stupid question but couldnt find the answer by googling Right now I analyze a malware by using remote debugger of IDA, and i run the debugger on a isolated VM that has shared a ...
2
votes
1answer
134 views

Breakpoint in GDB hit 144 times before first call to function

I am working on a reverse engineering challenge and have a binary file. I know how to get the flag by changing the instruction flow after doing a strcmp so I jump to the function that prints the flag....
0
votes
1answer
817 views

Ida - what is Parse C header file

In ida File->Load file there is option Parse C header file, I want to understand that . If I have the headers file that compiled with my binary I can attach and then see all the structures/function ...
13
votes
2answers
18k views

Extract SquashFS filesystem with shsq magic number

for a few days I was trying to extract the filesystem of a router firmware. Checking the image that the vendor provides I can see a SquashFS flag on it: DECIMAL HEX DESCRIPTION -----------...
2
votes
0answers
853 views

Extracting firmware image from binary

I have firmware file in .bin format, but I need get firmware.img image file and Kernel uImage file for reflashing bricked device. How can I get these parts? I used Binwalk to extract content, ...
1
vote
2answers
142 views

How to find sequence of numbers from 0-9 in a binary file?

I'd like to find a sequence of values in a 32MB data stream, where the values are all between 0x00 and 0x09 and there are about 20-40 of them in a row. Maybe this can be done with Hex Workshop, but i ...
16
votes
2answers
3k views

Decoding an unknown image format with "DREK" signature (*.drk)

There are some unknow images, which I would like to decode to RRGGBBAA format. It was a really hard work, but at the moment I can somewhat understand, that which part of the binary is responsible for ...
0
votes
1answer
187 views

BOSCH EDC development

I'm trying to reverse engineer some BOSCH EDCs firmware (there are many of them on the internet, for example: Here). To understand it better, I was wondering if someone has any idea how those EDCs ...
2
votes
1answer
176 views

Identifying Compiler Used for Binary File

I am trying to recreate a binary file from an analysis of "strings" output. I don't recognize which compiler was used for this file. It does not seem to be shc. Does anyone recognize this output ...
4
votes
0answers
94 views

JTAG Dumped Flash is scrambled

I dumped the flash memory of an old ARM9 Chip running VxWorks using the SEGGER J-Link and the savebin command from J-Link Commander. Here is an example of a line of HTML stored on memory. <!DOC^...
0
votes
1answer
798 views

Daikin A/C 4bit CRC/Checksum

I am reverse engineering IR protocol of Daikin A/C. AC sends the whole current state of remote on each key press. Data sent is 8 byte long, last 4 bits seem to be the some kind of error checking. ...
4
votes
1answer
610 views

Radare2 ptrace can not attach

First my setup: Linux Mint 64bit 4.15.0-20-generic radare2 the newest version from github /etc/sysctl.d/10-ptrace.conf = 0 Executable: ELF 64-bit LSB executable, x86-64 read write and ...
1
vote
0answers
95 views

Static binary instrumentation

I am working on a class project. I need to find out static features of a program (without executing it). Backward branches (loops) Conditional branches (potential threads with load imbalance) ...
1
vote
1answer
36 views

Confused about address being referenced

lea ebp, dword_403638 lea ebx, [ebp-4] mov edi, ss:[ebx] I understand the first instruction setting ebp to the address of the byte sequence. What I don't understand is what ebx will then ...
4
votes
1answer
223 views

How to find the index of static ilbrary functions in the PLT of the binary?

So right now I'm trying to resolve function calls and their names in my reversing tool the problem I'm having is that library functions such as printf and fwrite and such do not have a corresponding ...
1
vote
0answers
127 views

Reproduce compilation (ASM) output for library detection - identifying compiler, version & options used

I want to reverse a stripped x86 sample that uses a static library. So far I could identify the library itself and narrow the version of the library used. Now I want to use Ghidra's Function ID ...

1 2 3
4
5
10