Questions tagged [binary-analysis]

The process of gathering information about a binary file, either with static or dynamic methods.

Filter by
Sorted by
Tagged with
0
votes
1answer
186 views

Understand what Ioctl do

I looking in ida on arm linux binary . I can see there that there is ioctl call ioctl(fd,req,num). fd is fd to /dev/module. ,req is some 4bytes and num is some number. How can I understand what ...
3
votes
1answer
234 views

custom virtual machine protection

How someone would go to reverse engineer a sample protected with a virtual machine? The problem is that it's not opcode anymore it's bytecode which I don't have any idea about because it's a private ...
0
votes
1answer
114 views

What does this function actually do?

I'm taking part in this reverse engineering lab at college and we have this final big homework project. I have a part of the binary that changes it's own asm code by iterating through it's own bytes ...
2
votes
1answer
206 views

Which file system is this? file type 0x00, folder type 0x01

Inside a internet radio firmware file I found a file system, and I don't know which one it is. What I know: (The first two bytes are 0A 4C (maybe magic byte)) they are actually not part of the file ...
2
votes
2answers
349 views

GetProcAddress with 0 as lpProcName

I'm reversing a 32bit binary for a challenge I got at a college lab and I'm having a hard time trying to understand the intent of the asm code. The binary is a 10 level reversing game where you get ...
0
votes
0answers
387 views

unsquashfs failed to read SquashFS file

I tried to unpack binary which is SquashFS system, the file is mtd partition copied from NAND device, Root filesystem (read-only). Actually its SquashFS version, modifyed/patched by vendor. binwalk ...
1
vote
0answers
109 views

Using IDA to find pointer passed to procedure

Loading the source into IDA, I have this function: According to the source for Lua, this function should be passed a pointer to the Lua_State struct: LUA_API int lua_gettop (lua_State *L) { return ...
3
votes
0answers
962 views

How to extract DVB firmware bin file?

I have a bin file of DVB(DTH) box firmware I want to change one image inside that bin file how I can do this please guide me in right direction. I tried bin walk but the file that it extracted ...
0
votes
1answer
700 views

How to find out address in binary file (like IDA) with python code only?

I have binary for example https://github.com/andrew-d/static-binaries/blob/master/binaries/linux/x86_64/nmap that I open with IDA , and search some data that I want to find without open IDA ,only ...
0
votes
1answer
421 views

Ida - what is Parse C header file

In ida File->Load file there is option Parse C header file, I want to understand that . If I have the headers file that compiled with my binary I can attach and then see all the structures/function ...
1
vote
1answer
561 views

How to find the starting address of main function when the binary is stripped and _start doesn't push the absolute address value of main?

So let's say the ELF binary is stripped - meaning no symbol table - and the _start function doesn't push the address of main before calling __libc_start_main. This happened in a binary when compiled ...
2
votes
2answers
568 views

Unable to extract IP camera firmware

I am trying to extract the firmware for a Panasonic WV-S2131L ip camera. It comes as a .zip file that contains a .img file. I have tried many methods to try to analyze this file and I have found ...
4
votes
1answer
119 views

How to find the index of static ilbrary functions in the PLT of the binary?

So right now I'm trying to resolve function calls and their names in my reversing tool the problem I'm having is that library functions such as printf and fwrite and such do not have a corresponding ...
1
vote
1answer
73 views

What type of function gets called using a register instead of address in the binary? how to find the address statically?

So I'm trying to write a reversing tool right now and trying to make a CALL graph the problem I'm having is some calls are like Call *eax instead Call 'address' I can easily generate the call-graph ...
0
votes
1answer
268 views

How to split ARM code/data from binary in Inmarsat Isatphone Pro?

I'm analyzing the 3 binaries for updating firmware to the Inmarsat Isatphone Pro phone. Additionally, I'm following the Groundworks Technologies paper, and attempting to recreate their work as a ...
0
votes
1answer
168 views

me_cleaner and fwupd, or manipulating UEFI .cab files

I'd like to extract a plain dump of the UEFI firmware of my laptop (1:1 copy of the flash content, often called .bin or .rom files) from the .cap file, so that I can modify it slightly with me_cleaner....
7
votes
1answer
2k views

Can I define custom enum-type to be used in Ghidra as a data type?

I'm trying to learn Ghidra. Say, if it generated the following code for loading functions from an array of function names from gpfnCommCtrlAPI: I was able to retype gpfnCommCtrlAPI into char*[14] ...
1
vote
1answer
126 views

Best python framework/library for constructing the call-graph from binary?

So i have written a python tool using capstone that disassembles the code section of a ELF binary using capstone. now i want to also create and show the call-graph of this binary in a dot format, I ...
1
vote
1answer
187 views

View Array Type in dnSpy

I'm debugging a .NET application and see a declaration of a local array: $ArrayType$$$BY05PAD $ArrayType$$$BY05PAD; I break on an instruction that uses data inside that (char*) array: num9 = <...
9
votes
2answers
4k views

How to load symbols from a symbol server in Ghidra?

I've been trying to learn Ghidra by attempting to reverse the comctl32.dll system library, which has many of its functions documented. I started the de-compilation analysis in it, and after a while it ...
1
vote
1answer
200 views

Decryption loops

I'm reversing a CTF binary and I found a decryption loop decompiled by IDA like this: for ( i = 0; i < n; ++i ) { v22 = *((_BYTE *)sub_5657D89B + i); v0 = v22 ^ 0x90; v1 = strlen(&...
2
votes
0answers
40 views

How do I decode arbitrary data from a raw extracted binary?

I have a IoT scale that stores my measurements into records and passes them onto my phone. I was able to read directly off a flash chip and create a binary file. The chipset is ARMv7. I want to be ...
1
vote
0answers
148 views

Vulnerabilities of Binary executed by root

I was given a vulnerable 64bit dynamically linked stripped that runs simple checks to determine the strength of the passwords of users on a linux system. The app checks if it the EUID is 0 and then ...
0
votes
1answer
1k views

x86-64 CALL opcode + disassembly

Working a basic buffer overflow on a 64bit system and putting together some basic shellcode. The main program does a call to puts@plt. When I disassemble main in gdb, the opcodes show as: e8 6b fe ff ...
1
vote
0answers
128 views

Can anyone make much sense of this binary for an embedded system? [closed]

I want to see if anyone more experienced in reverse engineering and disassembly can take a look at this binary update file I have and maby ether help or just say if it is even possible to reverse it. ...
2
votes
1answer
164 views

Does a symbolic disassembler exist?

I would like to know if there are disassemblers based on a symbolic analysis, I'm beginner in RE, but I think that a disassembler based on symbolic techniques can be very interesting and could ...
0
votes
0answers
149 views

What is this function doing?

I have this function, named __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6__initEPKcm. And this is the relevant assembly: mov rdi, [rbp+var_A80] mov rsi, [rbp+var_A88] ...
1
vote
0answers
262 views

REing GameCube model (GCR) and texture (GCT) formats

I'm attempting to reverse engineer the mesh and texture formats used by the 2005 GameCube game "TimeSplitters: Future Perfect". Unfortunately, I'm not nearly good enough at this kind of thing to ...
1
vote
1answer
89 views

When can trapping be used?

This is the beginning of one of the functions inside NTDLL of Windows XP: MOV EDI,EDI PUSH EBP MOV EBP,ESP ... The book on reverse engineering I am reading(Eldad Eilam - Reversing: Secrets of ...
1
vote
0answers
86 views

Argument types not identified when parsing declarations

I'm trying to add a dynamic import segment in the IDA database which contains functions names, and I'm applying type information to it, so that I can obtain argument locations by using ...
1
vote
2answers
129 views

Calculation with not defined variables?

I am new to reverse engineering and try to solve a crackme with radare2. My problem is understanding of the following lines: | 0x000007a9 c745b8000000. mov dword [var_48h], 0 | ...
3
votes
1answer
1k views

Extract a secret from an Android apk or .so file

Context As an exercise I am researching all methods of hiding a secret in an android mobile app binary... Yes I know that with more or less effort they can always be extracted with static analyses, ...
0
votes
1answer
4k views

How to print the value of register with Radare 2

I am trying to solve this ELF - Ptrace challenge. I use Radare 2. This is the commands I execute to print the assembly code. radare2 ch3.bin [0x080482f0]> aaa [[anal.jmptbl] Missing cjmp bb in ...
2
votes
1answer
196 views

Radare2 does not display the entire assembler code

I am trying to solve this ELF - Ptrace crack me. Here are the commands I use : I start radare2 with the crack me as argument. radare2 ch3.bin I decide to go to the main and print the assembly code ...
0
votes
1answer
341 views

Combine various sub routines into one sub routine (IDA Pro)

Currently I am analyzing a .so file and there is a function which is supposed to be large (high number of nodes and edges). However, IDA Pro identified it as a small function, with various parts of ...
1
vote
2answers
169 views

Emotet invoice, what is the embedded file inside the word document

This pastebin hosts current URLs hosting the fake invoice of Emotet malware, which is the dropper part of the malware. The document is a Office Open XML, and there are two large non textual segments ...
-1
votes
2answers
2k views

XOR encryption - How to find the key?

I'm trying to solve a crackme which basically uses a XOR encryption scheme in which the password is used as the key to an encrypted buffer which is subsequently executed. The following is the ...
1
vote
0answers
139 views

How can a segfault happen during the libc exit call on Linux?

I'm relatively new to reverse engineering, and I've decided to practise using the challenges from pwnable.tw. Currently, I am working on the "Silver Bullet" challenge. While testing, I have noticed ...
2
votes
1answer
233 views

ROP chain: Buffer Overflow Return Pointer

I am trying to get a ROP exploit to work on Ubuntu 18.04 LTS 64bit. I have a 64 bit binary (Nx enabled, ASLR disabled) with vuln function as follows: public vuln vuln proc near var_100= byte ptr -...
1
vote
1answer
187 views

IDA - large jump table, missing cases in analysis

I have come across the following jump table with a large amount of cases (160+). There seems to be cases missing from IDAs analysis though. For example it skips from cases 22 -> 38 -> 91, and I can ...
1
vote
1answer
147 views

rip adress not visible with dr command

I just finished this challenge. This is the content of main function : [0x08048a86]> pdf / (fcn) main 417 | main (int argc, char **argv, char **envp); | ; var int local_16h @ ebp-0x16 |...
3
votes
1answer
127 views

Debug point not hit with radare2

I am doing this reverse engenering challenge. I executed theses commands to analyse the main function : radare2.exe ch15.exe aaa s main pdf This is the output of the pdf command : [0x004017b8]> ...
1
vote
2answers
405 views

Lots of mov instructions into ebp+offset - What is happening?

While learning RE I have come across this large segment of instructions that contains a majority of mov [ebp+offset], value instructions. I believe that ebp + offset are local variables? I think? ...
2
votes
1answer
578 views

How to reverse engineer a Black Box?

I am trying to reverse engineer / research a black box system, this is, a system for which there is no public information at all. Let's say the system is a modern handheld console. I have already ...
0
votes
1answer
83 views

How to determine number and/or boundaries of linked object files in a PE generated by Visual Studio 6?

In this analysis of a Portable Executable linked using Microsoft Linker (6.0), down in the Imported Objects section, the website makes some very specific claims: 3 .OBJ Files (COFF) linked with LINK....
1
vote
1answer
64 views

What are those instructions doing?

I'm having a hard time figuring out whatever the hell this is doing. mov rax, [rbp+var_720] mov [rbp+var_458], rax mov rax, [rbp+var_458] mov [rbp+command_], rax mov rax, [rbp+...
0
votes
1answer
394 views

How do I interpret the mangled functions name?

I am going to start by saying that this is my fourth attempt at reverse engineering a crackme and I'm starting to understand how assembly works, which is cool. I am sorry if this question is wrong or ...
1
vote
2answers
583 views

pwntools shellcode narnia2

I'm trying to solve the narnia2 challenge on overthewire. I read a guide for help and managed to overwrite the stack with A's using some python $(python -c "print 'A'*132 + '\xef\xbe\xad\xde'") ...
1
vote
1answer
2k views

Impossible to execute a program with radare2 : TO DO continue

I am trying to crack a crackme. I already catch the flag because I seen the string variable which represants flag. I would like to catch the flag on an other way, I want to set a breakpoint when there ...
0
votes
1answer
252 views

Why can't I decode this UART signal?

I have a modem that I'm trying to get into. It's composed of two SoCs, both with UART headers. I was already successful trying to connect to the first SoC's UART, with my USB-to-UART CP2102 decoder ...

1 2
3
4 5
9