Questions tagged [binary-analysis]
The process of gathering information about a binary file, either with static or dynamic methods.
523
questions
9
votes
2
answers
2k
views
Decoding an ancient format
It's a very interesting file format may greatly satisfies binary archaeologists. sample file
Background
This file format was created in 90s to archive customer created AutoCAD components library ...
2
votes
2
answers
4k
views
Decoding a blob
I have a proprietary file format that is a compressed database file. This database file has a few dozen tables. Each of these tables only have a few records, many of them don't have any records at all....
25
votes
6
answers
8k
views
Tool or data for analysis of binary code to detect CPU architecture
Assuming that I have binary file with code for an unknown CPU, can I somehow detect the CPU architecture? I know that it depends mostly on the compiler, but I think that for most CPU architectures it ...
- 385
7
votes
3
answers
6k
views
unpack Clear spot .bin firmware update
I am trying to unpack a clear spot firmware update
The firmware I am trying to reverse can be found on the download page of the vendor
I have used the fwtools to unpack the firmware as described on ...
- 71
13
votes
3
answers
8k
views
Totally unknown file analysis approaches
I guess this is the worst case. I have a file which was initially base64 encoded. This step was easy. But now all I can see is a bunch of rubbish. No structure, nearlly a maximum of entropy, no ...
- 231
4
votes
1
answer
1k
views
Recreating 2D aspects of Cantor.dust
I'm trying to recreate some of the 2D capabilities that were demonstrated in cantor.dust, I was wondering if anyone knows how they translate a large file(executable) into a number of different images /...
- 41
10
votes
2
answers
1k
views
Binary instrumentation with Python
I'm interested in performing (dynamic) binary instrumentation using Python to be able to analyze the binary by instructions during execution for
Windows
Linux
Can someone suggest such tool/framework?...
- 3,002
5
votes
1
answer
3k
views
How to reverse command line arguments?
I am working on a console windows executable. So far what I figured out is that the executable checks number of command line arguments. Afterwards, it branches out depending on the number of arguments ...
- 3,068
15
votes
2
answers
19k
views
Extract SquashFS filesystem with shsq magic number
for a few days I was trying to extract the filesystem of a router firmware. Checking the image that the vendor provides I can see a SquashFS flag on it:
DECIMAL HEX DESCRIPTION
-----------...
- 715
20
votes
2
answers
5k
views
Why are GOT and PLT still present in Linux static stripped binaries?
I am looking at statically linked linux x86 stripped binary. I noticed that there are .got and .plt sections.
I wonder what does a statically linked binary need got and plt sections for ? Anyone ?
- 603
5
votes
1
answer
3k
views
Find file signatures inside an unknown file
I have a .bin file I would like to analyse. Especially find images embedded in this firmware update.
binwalk couldn't find anything.
What other tools do you know to search for possible embedded ...
- 3,039
6
votes
2
answers
387
views
Find level data in binaries?
I am trying to recreate an old game just for the sake of nostalgia and learning something new alongside (I can program in various languages and know a bit of assembly language, but I'm new to reverse ...
- 163
7
votes
4
answers
24k
views
Is there any tool for decompiling raw binary files to C code for the Motorola 68000 processor series?
I have the ROM dump (.bin files) targeted for the MC68008 processor. Need to convert them into a high level source code. I have already found tools for disassmbling them into assembly code. The next ...
5
votes
4
answers
2k
views
Is BinNavi available? If not, can I get the source from anywhere?
BinNavi is originally a Zynamics product. But, since the company has been bought by Google, it seems to be difficult to get the library.
I tried to look in the BinNavi manual in the installation ...
- 18.7k
131
votes
2
answers
118k
views
What is PLT/GOT?
From time to time, when disassembling x86 binaries, I stumble on
reference to PLT and GOT, especially when calling procedures from a
dynamic library.
For example, when running a program in gdb:
(gdb)...
- 18.7k
4
votes
1
answer
740
views
On SPARC, what happens when a branch is placed in the branch-delay slot of another branch?
Our team recently had to look at SPARC assembly specifications, the problem is that I do not have a SPARC processor to try things on it (I should set up a simulator or get one of these old Sparc ...
- 18.7k
13
votes
5
answers
1k
views
How do you store your data about a binary while performing analysis?
Since now, when I am analyzing a binary, I'm using a "pen and paper" method to locate the different location of the function, the different type of obfuscations, and all my discoveries. It is quite ...
- 18.7k
61
votes
8
answers
36k
views
how can I diff two x86 binaries at assembly code level?
I'm looking for a tool like Beyond Compare, meld, kdiff, etc. which can be used to compare two disassembled binaries. I know that there's binary (hex) comparison, which shows difference by hex values, ...
- 4,755
11
votes
1
answer
3k
views
What are the main features of radare2?
Radare2 is a framework for reverse-engineering gathering several tools (see this Phrack article about radare1 to know a bit more about the framework).
I would like to know if someone could point out ...
- 18.7k
9
votes
1
answer
2k
views
What are the differences between BitBlaze and BAP?
BitBlaze and BAP are two platforms to perform binary analysis. And, if I understand well, they are sharing lots of common features. What are their respective main features and in what do they differ ...
- 18.7k
23
votes
4
answers
7k
views
What is "overlapping instructions" obfuscation?
I analyzed some binaries in x86/x86-64 using some obfuscation tricks. One was called overlapping instructions. Can someone explain how does this obfuscation work and how to work around?
- 18.7k
12
votes
3
answers
8k
views
Reverse engineer an old DOS QBasic executable
I recently decided to try my hand at reverse engineer an old DOS text based game that was coded in QBasic.
I found some info online about old DOS games disassembly but mostly for Wacom compiled C/C++ ...
- 121
6
votes
1
answer
263
views
What is the scalability of state of the art static binary analysis techniques?
What is the largest program that has been analyzed by a semantics-based static binary analysis?
By semantics-based, I mean an analysis that examines the meaning of the program, and does not simply ...
- 944