Questions tagged [binary-analysis]

The process of gathering information about a binary file, either with static or dynamic methods.

Filter by
Sorted by
Tagged with
1
vote
1answer
464 views

Defining all undefined functions

I analyzed a binary, and lots of functions weren't detected as such - the bytes weren't detected as assembly. I read about the Aggressive Instruction Finder analysis and used it. Now the instructions ...
0
votes
0answers
103 views

How do reverse-engineers feel comfortable with not knowing the 'big picture'?

One of the biggest barriers in my journey of learning reverse-engineering seems to be the fact that I feel rather uncomfortable being confused about the 'big picture' of what I am reversing and not ...
0
votes
0answers
112 views

Unpack old DLink DIR-855 firmware

I'm trying to reverse engineer an old firmware of the D-Link DIR-855. The latest binary can be found here: ftp://ftp.dlink.de/dir/dir-855/driver_software/DIR-855_fw_reva_124eub01_ALL_multi_20130614....
0
votes
1answer
87 views

Getting the object name through the Ghidra Script

I have a script written to work with Ghidra. I am doing some analysis in the script and save the results in a file. Right now, I am passing the name when a prompt ask the file name to save upon ...
2
votes
0answers
154 views

Modify bin firmware file of an old phone

I am trying to remove/disable some system apps ( Messages, Games, Radio or Calendar ) and remove/replace the boot screen from samsung E1200y. So i start searching for the way to do that... I used HxH ...
1
vote
1answer
260 views

Alternative to BinDiff that works on Linux x86_64 binaries (and preferably does not require IDA Pro)

Is there alternative to https://www.zynamics.com/bindiff.html that works for Linux x86_64 binaries, works on Linux, (and preferably does not require IDA Pro, however if needed it seems that IDA can ...
0
votes
0answers
126 views

binwalk not showing file descriptions (signatures) after 1st try

I have a bin file that shows a list of lzma compressed files which I extracted generically to .7z files using this format "binwalk -D "elf 32-bit lsb shared object":.so image.bin" ...
2
votes
0answers
80 views

Advice for retrieving functions and tables from Intel 8061/8065 bin file (reverse engineering) from Ford EECV ECU

I have under my disposal some Ford EECV bin files and my goal for the next few weeks is to retrieve the functions and tables, and plot them out before going onto DIY hardware. Does anyone know which ...
3
votes
1answer
139 views

Confusing syntax found in malware

I am confused by what the following command is doing: 00401234 mov dword [esp+0x35], sub_408678 For context, I'm reversing a piece of malware and am using Binary Ninja, which to my knowledge ...
0
votes
0answers
37 views

Radare2: Running executable from a specific point

I am using radare2 to reverse engineer a standard crackme executable. I have obtained the password, but now I need use the program to read & print a restricted file to which the executable has ...
1
vote
1answer
273 views

Statically Reverse Engineering Shellcode - IDA to Ghidra

I'm trying to follow along with this tutorial which is using IDA in it's example. https://0ffset.net/reverse-engineering/malware-analysis/common-shellcode-techniques/ Hash: ...
0
votes
0answers
66 views

String as constant , even not visible in disassembler

I was reading this article Where I saw that while reversing the WinRAR I saw that the x64dbg is not able to search for a string in all modules "evaluation copy". but why is that happening. ...
0
votes
0answers
406 views

Modify Strings in a ELF (Executable and Linking Format) that are stored in the .rodata

I have 2 ELF files here, each containing strings in the ".rodata" for an translation that I want to modify. The first ELF "(binary1)" I have already successfully modified from ...
0
votes
1answer
145 views

Static Binary in Windows

I am learning more about binary exploitation on windows. But I saw while revering a binary that you can create static binaries in windows too just like in Linux. It was really ugly. if I would be on ...
0
votes
2answers
670 views

How to find the file address of AddressOfEntryPoint

I have a binary file and in the optional header I have the address of the entry point 0x00011046 but when I put the file inside HEX editor this address doesn't exist, more than that 0x000097f0. I ...
5
votes
2answers
1k views

Difference between Main and Entry

Sometimes, I see while disassembling a binary that there is the main function. but sometimes, instead of main, there is entry function. I want to know what is the difference between entry and main.
0
votes
2answers
196 views

What should I learn in order to reverse elf64 binary files

I'm a little confused. I am using a Linux based system (Ubuntu), 64-bit. and I want to start and reverse 64elf binary files, but there is a lot of things I want to know before. just to be clear, If I ...
2
votes
1answer
305 views

How do we decompile java so easy?

I have seen a lot of videos where everyone is decompiling the jar files so easily. but I learnt that we cannot decompile any compiled file so easily. I have a little bit of experience in Gidhra. I ...
1
vote
1answer
73 views

Confusion between different ARM architectures

I am trying to develop a machine learning model to help with the process of reverse engineering. As the first stage, we are currently trying to train an embedding model that understand the ...
1
vote
1answer
80 views

Identifying the nature and contents of a file

As a preface, I do not have any experience in reverse engineering. I am an application developer, so this field is way out of my area of expertise. My end goal is to create a web page out of this ...
2
votes
1answer
320 views

How to extract information from a binary file knowing the target info

I have some measured data comes from a various types of sensors. The sensors are connected to a data-logger in order to store measurement data. After measurement, the data transported and stored in a ...
0
votes
2answers
102 views

How does an executable’s static API differ from it’s dynamic API?

Running an executable in Cuckoo sandbox gives me its dynamic API information. How do these API calls differ from their static API information (eg. If I were to just put the executable through IDA Pro ...
0
votes
1answer
493 views

How to find function start in stripped binary?

Given C code, are the function addresses from the ELF the same as those in the stripped version? I don't have any specific code in mind. Just trying to learn in general how to find the function ...
1
vote
0answers
34 views

PE Format - How can I delete IMAGE_IAT_DIRECTORY and the app still runs fine?

I’m doing a small research regarding PE files and while I drilled every related question or the documentation itself I couldn’t explain this issue. Why can I go to CFF explorer or some other PE ...
2
votes
1answer
159 views

Getting android app from device for reversing - what if there are multiple apks?

For analyzing and reversing android apps, where the target app is installed on an android phone, usually there is a base.apk file on the device, and there are various ways to find this apk file on the ...
5
votes
2answers
392 views

What kind of function creates this code pattern?

Apologies if this is a duplicate. Don't know what words to search for as that's what the question is about. I'm relatively new to reverse engineering binaries and while using Ghidra I've noticed that ...
3
votes
2answers
563 views

C++ Unary equals (unary operator=)

In C++ binaries, I find Qt methods like ??4QString@@QEAAAEAV0@AEBV0@@Z which demangle to public: class QString & __ptr64 __cdecl QString::operator=(class QString const & __ptr64) __ptr64 or ...
2
votes
1answer
696 views

How to set the type of a variable or function to an std::string?

I'm using IDA Pro and have identified a function that takes an std::string as an argument. However when I click on the function and "Set Item Type", entering its definition: std::__ndk1::...
1
vote
1answer
5k views

What does 'test al, al' mean?

I'm trying to reverse engineer a program and i found the following instruction: test al, al je label what does these two instruction do ? Can someone explain please ?
9
votes
0answers
608 views

Extracting strings from Go binaries

Is there an easy way to extract all of the strings from Go binaries that will work cross architecture? The problem with Go is that strings are stored without a null terminator, so you can't use the &...
1
vote
0answers
85 views

What to do with a text file of disassembly code and binaries?

I am fairly new to software reverse engineering and I'd like to know how proceed with analyzing a program if I have a text file of disassembly code and a bin file of binary data. I understand ...
0
votes
0answers
70 views

Combine two ELF binaries

Without having access to the original source code, is there a way to combine two ELF binaries with the main() in the first binary pointing to the main() in the second binary ? In other words, I mean ...
0
votes
1answer
302 views

How to reverse engineer Apple MacBook SMC update firmware image using IDA Pro 7.2?

Alright so I have watched extraordinary presentations videos from three different reverse engineers who hacked the Apple SMC Update firmware: Charlie Miller: https://www.youtube.com/watch?v=...
1
vote
0answers
43 views

dwarf: variable offset from base

I have a simple code: int main() { int a = 4; printf("%d\n", a); a = 8; if (a == 8) printf("%d\n", a); return 0; } DIEs for the function and variable: <1><32a>: Abbrev ...
0
votes
1answer
81 views

Need some help and advices as regards as reverse engineering IoT devices

Hi everyone, I saw this video on youtube as regards as reversing IPTV cameras and finding security vulnerabilities: Black Hat 2013 - Exploiting Network Surveillance Cameras Like a Hollywood Hacker I ...
1
vote
1answer
304 views

Recognize binary architecture

I have binary that run on Arm Thumb cpu, in embedded devive that not running Linux. When I tried to run bimwalk or file ,and even open it with Ida ,but they didn't find out that this binary run on ...
1
vote
1answer
105 views

Can I make a DDS image from headerless DDS data?

I have some files which I've decrypted that I believe are DDS images. These files do not have a DDS header, however the data looks similar to what I've seen in other DDS images. I believe to a great ...
12
votes
2answers
3k views

What are some ways to pass raw bytes to a program via the Linux terminal?

I want to pass raw bytes to a (C) program using the Linux Bash shell. I find that when I try to pass for example "\x00\xFF\xAB", the program receiving the input actually gets the ASCII character codes ...
0
votes
1answer
215 views

Replace string in hexa with a longer one in .bin without destroying the structure (in .data)

I would like to replace some hard-coded strings in a compiled exe (in .data) which is in chinese (with no possibility to put it in other languages). I managed to replace strings in hexadecimal with ...
1
vote
0answers
45 views

Main contemporary deobfuscation techniques

Could you please specify in a few words main contemporary deobfuscation techniques which we can apply to 32/64 bit PE files? For example, (1) using instruction templates, such as: mov edx, 5B1F04F1h ...
-1
votes
2answers
826 views

Getting the function's original file name within Ghidra

I am trying to extract the original file name of some functions through Ghidra. In particular I have enabled the debug symbols so that it does contains the function names in the disassembly listing ...
4
votes
2answers
1k views

Function prototypes given by Ghidra is not consistent

This is a follow up question to the question I posted over here. According to the answer, I was able to get all the function prototypes from the binary. However, the problem I am having is most of the ...
1
vote
1answer
820 views

Way to get all the function prototype using Ghidra

I have been trying to extract the function prototypes from a binary file using Ghidra. Up till now what I have done was to use Ghidra's included "Decompile" script and filtered out the function ...
0
votes
0answers
73 views

Jump without jmp near

I need to jump a Hello, I need to jump some lines that lock program in a loop status. i use process hacker to find lines with string in binary but when i find this lines i have not jumps near, in ...
0
votes
1answer
130 views

In IDA, cannot find xrefs to string in ARM little-endian bootloader/firmware

In this firmware that is ARM Little endian. There is two strings : 0x00006953 : Foretrex 701 0x00006960 : Foretrex 601 The issue, is there is no direct Xreft to any of thoses strings ? For the ...
0
votes
2answers
107 views

Convert series of hex digits represented as ASCII-characters stored in a .txt file to raw bytes

I recently extracted a bunch of raw bytes (from wireshark) into a regular .txt file. Because these raw bytes are stored in a text file, all those hex-digits are actually written as ASCII characters ...
3
votes
3answers
1k views

Way to get basic blocks of a binary using Ghidra

I am using ghidra to do some reverse engineering of an ARM binary. I am wondering whether there is a way to get the basic blocks related to all the listing. Is there a function through the IDE or a ...
1
vote
2answers
78 views

Gui disabled program functionality

Right now I'm performing analysis of a GUI based application and I'm trying to determine all of it's available functionality. Right now there's one button remaining labeled "Encrypt", which is greyed ...
0
votes
1answer
1k views

Dumping the GOT with gdb at run time

I want to see how the plt stubs are being resolved at run time when lazy linking is used and how the GOT is changed along the way. How can I dump the GOT with gdb?
3
votes
1answer
143 views

Review a collection of executable binaries to determine similarity

I have a collection of different binaries I want to review for code similarity and classification, but I would rather not have to open each of them in IDA and manually review the code in 15 different ...

1
2
3 4 5
10