Questions tagged [binary-analysis]
The process of gathering information about a binary file, either with static or dynamic methods.
524
questions
2
votes
1
answer
264
views
Identifying the nature and contents of a file
As a preface, I do not have any experience in reverse engineering. I am an application developer, so this field is way out of my area of expertise. My end goal is to create a web page out of this ...
2
votes
1
answer
511
views
How to extract information from a binary file knowing the target info
I have some measured data comes from a various types of sensors. The sensors are connected to a data-logger in order to store measurement data. After measurement, the data transported and stored in a ...
- 23
0
votes
2
answers
179
views
How does an executable’s static API differ from it’s dynamic API?
Running an executable in Cuckoo sandbox gives me its dynamic API information. How do these API calls differ from their static API information (eg. If I were to just put the executable through IDA Pro ...
- 27
0
votes
1
answer
1k
views
How to find function start in stripped binary?
Given C code, are the function addresses from the ELF the same as those in the stripped version?
I don't have any specific code in mind. Just trying to learn in general how to find the function ...
- 103
1
vote
0
answers
41
views
PE Format - How can I delete IMAGE_IAT_DIRECTORY and the app still runs fine?
I’m doing a small research regarding PE files and while I drilled every related question or the documentation itself I couldn’t explain this issue.
Why can I go to CFF explorer or some other PE ...
- 133
2
votes
1
answer
306
views
Getting android app from device for reversing - what if there are multiple apks?
For analyzing and reversing android apps, where the target app is installed on an android phone, usually there is a base.apk file on the device, and there are various ways to find this apk file on the ...
- 454
5
votes
2
answers
835
views
What kind of function creates this code pattern?
Apologies if this is a duplicate. Don't know what words to search for as that's what the question is about.
I'm relatively new to reverse engineering binaries and while using Ghidra I've noticed that ...
- 65
3
votes
2
answers
589
views
C++ Unary equals (unary operator=)
In C++ binaries, I find Qt methods like ??4QString@@QEAAAEAV0@AEBV0@@Z which demangle to
public: class QString & __ptr64 __cdecl QString::operator=(class QString const & __ptr64) __ptr64
or ...
- 131
2
votes
1
answer
2k
views
How to set the type of a variable or function to an std::string?
I'm using IDA Pro and have identified a function that takes an std::string as an argument.
However when I click on the function and "Set Item Type", entering its definition:
std::__ndk1::...
- 121
1
vote
1
answer
13k
views
What does 'test al, al' mean?
I'm trying to reverse engineer a program and i found the following instruction:
test al, al
je label
what does these two instruction do ? Can someone explain please ?
12
votes
1
answer
2k
views
Extracting strings from Go binaries
Is there an easy way to extract all of the strings from Go binaries that will work cross architecture?
The problem with Go is that strings are stored without a null terminator, so you can't use the &...
- 221
1
vote
0
answers
229
views
What to do with a text file of disassembly code and binaries?
I am fairly new to software reverse engineering and I'd like to know how proceed with analyzing a program if I have a text file of disassembly code and a bin file of binary data. I understand ...
- 11
0
votes
0
answers
389
views
Combine two ELF binaries
Without having access to the original source code, is there a way to combine two ELF binaries with the main() in the first binary pointing to the main() in the second binary ?
In other words, I mean ...
- 156
0
votes
1
answer
555
views
How to reverse engineer Apple MacBook SMC update firmware image using IDA Pro 7.2?
Alright so I have watched extraordinary presentations videos from three different reverse engineers who hacked the Apple SMC Update firmware:
Charlie Miller:
https://www.youtube.com/watch?v=...
- 1
1
vote
0
answers
109
views
dwarf: variable offset from base
I have a simple code:
int main()
{
int a = 4;
printf("%d\n", a);
a = 8;
if (a == 8)
printf("%d\n", a);
return 0;
}
DIEs for the function and variable:
<1><32a>: Abbrev ...
- 1,707
0
votes
1
answer
99
views
Need some help and advices as regards as reverse engineering IoT devices
Hi everyone, I saw this video on youtube as regards as reversing IPTV cameras and finding security vulnerabilities: Black Hat 2013 - Exploiting Network Surveillance Cameras Like a Hollywood Hacker
I ...
user32648
1
vote
1
answer
942
views
Recognize binary architecture
I have binary that run on Arm Thumb cpu, in embedded devive that not running Linux.
When I tried to run bimwalk or file ,and even open it with Ida ,but they didn't find out that this binary run on ...
1
vote
1
answer
231
views
Can I make a DDS image from headerless DDS data?
I have some files which I've decrypted that I believe are DDS images. These files do not have a DDS header, however the data looks similar to what I've seen in other DDS images. I believe to a great ...
13
votes
2
answers
7k
views
What are some ways to pass raw bytes to a program via the Linux terminal?
I want to pass raw bytes to a (C) program using the Linux Bash shell. I find that when I try to pass for example "\x00\xFF\xAB", the program receiving the input actually gets the ASCII character codes ...
- 1,770
0
votes
1
answer
618
views
Replace string in hexa with a longer one in .bin without destroying the structure (in .data)
I would like to replace some hard-coded strings in a compiled exe (in .data) which is in chinese (with no possibility to put it in other languages).
I managed to replace strings in hexadecimal with ...
- 15
1
vote
0
answers
55
views
Main contemporary deobfuscation techniques
Could you please specify in a few words main contemporary deobfuscation techniques which we can apply to 32/64 bit PE files?
For example, (1) using instruction templates, such as:
mov edx, 5B1F04F1h
...
- 131
-1
votes
2
answers
2k
views
Getting the function's original file name within Ghidra
I am trying to extract the original file name of some functions through Ghidra. In particular I have enabled the debug symbols so that it does contains the function names in the disassembly listing ...
- 271
4
votes
2
answers
2k
views
Function prototypes given by Ghidra is not consistent
This is a follow up question to the question I posted over here. According to the answer, I was able to get all the function prototypes from the binary. However, the problem I am having is most of the ...
- 271
1
vote
1
answer
2k
views
Way to get all the function prototype using Ghidra
I have been trying to extract the function prototypes from a binary file using Ghidra. Up till now what I have done was to use Ghidra's included "Decompile" script and filtered out the function ...
- 271
0
votes
0
answers
111
views
Jump without jmp near
I need to jump a
Hello,
I need to jump some lines that lock program in a loop status.
i use process hacker to find lines with string in binary but when i find this lines i have not jumps near, in ...
- 1
0
votes
1
answer
325
views
In IDA, cannot find xrefs to string in ARM little-endian bootloader/firmware
In this firmware that is ARM Little endian.
There is two strings :
0x00006953 : Foretrex 701
0x00006960 : Foretrex 601
The issue, is there is no direct Xreft to any of thoses strings ?
For the ...
- 1
0
votes
2
answers
182
views
Convert series of hex digits represented as ASCII-characters stored in a .txt file to raw bytes
I recently extracted a bunch of raw bytes (from wireshark) into a regular .txt file. Because these raw bytes are stored in a text file, all those hex-digits are actually written as ASCII characters ...
- 15
5
votes
3
answers
2k
views
Way to get basic blocks of a binary using Ghidra
I am using ghidra to do some reverse engineering of an ARM binary. I am wondering whether there is a way to get the basic blocks related to all the listing. Is there a function through the IDE or a ...
- 271
1
vote
2
answers
147
views
Gui disabled program functionality
Right now I'm performing analysis of a GUI based application and I'm trying to determine all of it's available functionality.
Right now there's one button remaining labeled "Encrypt", which is greyed ...
- 173
3
votes
1
answer
5k
views
Dumping the GOT with gdb at run time
I want to see how the plt stubs are being resolved at run time when lazy linking is used and how the GOT is changed along the way. How can I dump the GOT with gdb?
- 397
5
votes
1
answer
192
views
Review a collection of executable binaries to determine similarity
I have a collection of different binaries I want to review for code similarity and classification, but I would rather not have to open each of them in IDA and manually review the code in 15 different ...
- 173
1
vote
0
answers
20
views
Locating Exit/Abort Functions from Static Analysis
Similar to this question, I'm interested in locating exit and abort style functions in a firmware - any function call that in fact terminates the execution, by statically analyzing the firmware.
My ...
- 1,798
1
vote
1
answer
2k
views
Extracting functions of .obj file (compiled by myself with Visual Studio 19) --> extracts wrong data
How can I find only real functions not data garbage like section..debug_S_105 ? *
I need to collect function data (assembler code) of Open Source C++ Files which I compile with Visual Studio 19 (sln ...
- 23
0
votes
0
answers
373
views
reversing xiaomi update firmware encrypted?
I am playing around with a xiaomi firmware [mijia_4k_0.6.16.02] for a camera
Running binwalk on the file I see this output
DECIMAL HEXADECIMAL DESCRIPTION
----------------------------------...
1
vote
1
answer
211
views
empty .data section in AARCH64 elf binaries
My question is: Why does readelf -x .data bin.so give me empty data when ghidra does not? (0x00 repeated for section length until last element 0xFFFFFFFF).
ghidra/JEB contradict me by showing that ...
- 13
1
vote
1
answer
193
views
Questions regarding PLT/GOT and statically linking
I am looking at the assembly code of a heap-overflow challenge (heap3 in Protostar) which uses a vulnerability of an old version of dlmalloc to execute the exploit. Below is the assembler dump:
...
- 11
0
votes
0
answers
160
views
Tools for statistical analysis of binary streams
I'm in the process of decoding the semantics of an unknown binary stream1. I've come to a point where I understand the overall structure: A tag byte, followed by a size field, and a blob of bytes of ...
- 101
2
votes
1
answer
96
views
Is there a standard documentation format for file formats?
I'm analysing an undocumented file format. Is there a standard documentation format for file formats I can write up? Something of this level of complexity and detail? What I have in my mind is,
!...
- 177
1
vote
0
answers
651
views
Extract files of a SquashFS Filesystem
I already asked a similar question but after a deeper analysis of the filesystem I found out that I misunderstood the problem and that's why I decided to delete the old question and make a new one.
I ...
- 108
0
votes
1
answer
168
views
Is it possible to extract the binary firmware of a feature phone? [closed]
I am new at reverse engineering but very eager to learn. I have a feature phone it5081 and downloaded it's binary firmware. I have googled and came to know about tools like binwalk,firmware mod kit as ...
3
votes
1
answer
245
views
Importance of learning file structures for reverse engineering?
I'm new to reverse engineering and I have started to study the anatomy of specific file formats, specifically PE right now. I really enjoy learning the different parts of the files and the different ...
- 105
1
vote
2
answers
3k
views
running IDA python without gui
I am trying to run IDA without GUI. My purpose is to run a specific script that receives arguments via my main program against multiple files, but for some reason, it does not work for me. Sometimes ...
- 71
0
votes
1
answer
219
views
CISC/RISC in reverse engineering
What is the difference between CISC/RISC when reverse engineering a binary?
I know the difference between them, but is there any difference while reversing? Is it easier to reverse CISC than RISC?
1
vote
1
answer
137
views
Which JSON object compact binary serialization is this?
I am trying to reverse engineer an unknown JSON binary serialization format found in a request-response pair between a mobile app, and a server.
Does anyone recognize this? I've attached the first ...
- 11
2
votes
1
answer
208
views
Finding "func main" in a stripped binary written in GO
I'm reversing a binary that was apart of a CTF I was involved in about a month ago. It was too large of a binary to do during the challenge so I am doing it now.
I am having trouble finding the main ...
- 105
2
votes
0
answers
183
views
submitting input into AFL fuzzer
I have some questions about the AFL Fuzzer:
How does the AFL Fuzzer know where to inject the payload in the code I compile? For instance if I want to inject it in a specific parameter, how do I do it?...
- 71
5
votes
1
answer
317
views
Are there existing automated approaches to reverse engineering the data types in a binary data stream?
Consider a stream of data packets of a known and consistent size, i.e., N bytes per packet.
Are there existing tools that automatically detect (or estimate) the various data types present and their ...
- 151
0
votes
0
answers
285
views
How can I find loading adress of eCos firmware
From:https://www.tendacn.com/en/download/detail-3482.html
Im trying to find loading address (entry point of my program) for this binary, which is part off this firmware. Im trying to load it inside ...
2
votes
2
answers
503
views
Prevent Memory Inspection in a Cython program?
Cython is a great way to protect the source code of a Python program. However, memory inspection and memory reverse engineering can still be done to this Cython program.
What are ways to prevent (or ...
- 21
1
vote
1
answer
547
views
Reversing a key-gen firmware for RISC-V
I would like to study this firmware for Sipeed MAix, a RISC-V development board. You can download it here: key_gen_v1.2.zip. As the name suggests, its purpose is to
calculate and print a "machine key"...
- 121