Questions tagged [binary-analysis]
The process of gathering information about a binary file, either with static or dynamic methods.
524
questions
0
votes
0
answers
229
views
Is there a way to see 'imports' in a .NET binary?
Programs such as Detect It Easy or IDA can show functions and libraries (DLLs) imported by a binary in the case of C/C++ binaries. I have a collection of .NET malware that I'm analyzing and would like ...
- 233
2
votes
2
answers
488
views
gdb shows that EBP contains a value other than some address(which is what it is supposed to contain). How is this possible?
I am fairly new to RE and Binary Exploitation, I have learned basic assembly instructions for Binary Exploitation and I was doing Protostar exercises (stack0) in which I have to simply overflow the ...
- 23
0
votes
1
answer
183
views
x64dbgpy: application unresponsive when trying to automate inside breakpoint callback
When a breakpoint callback is triggered trying to automate the debugger inside the callback causes the application to become unresponsive. x64dbg continues functioning but the application itself doesn'...
- 103
5
votes
0
answers
278
views
Radare2 8051 code bank switching
Some of 8051 chips use bank switching to extend accessible code memory.
Good example is Silabs C8051F12x. Another example is here.
Code area in range 0x0000..0x7ffff is common always accessible code ...
- 159
1
vote
1
answer
234
views
Deciphering an unknown graphics format
For my own amusement, I dumped the files of an old Nintendo DS video game I have (the company has long since gone bankrupt/closed) and am trying to extract the assets. I have recovered game text, ...
- 113
2
votes
3
answers
610
views
Decode synth preset formats for massive (.nmsv) fm8 (.nfm8) and absynth (.nabs)
I'm trying to decode the file formats for Massive, FM8 and absynth VST synths. The file format is binary with several sections. Reason for this endeavour is to convert the above formats to general vst ...
- 23
2
votes
0
answers
184
views
What's the pattern in this sequence extracted from a LYR document, used by the ESRI ArcGIS
I'm trying to reverse engineer a binary format, and I'm running up against a variable-length sequence of numbers which varies between files. I can't work out the pattern here and how to determine how ...
- 73
1
vote
3
answers
634
views
What is the difference between malware that is 'dumped' and one that is 'unpacked'?
On malware sharing communities, I have been noticing that the samples shared are marked as unpacked or dumped. I have tried to load the dumped malware in IDAFree, however, there is nothing in the ...
- 233
2
votes
0
answers
249
views
Google Maps, Android serialisation format
I've come across an SQLite database (gmm_storage.db) used by Google Maps on Android, and I'm unsure as to how the data it contains is serialised. For example:
I'm saying serialised, as from the ...
- 121
2
votes
1
answer
459
views
How can I determine a module to which function is related with IDA Pro
For example I have a function sub_7FFA95D8F120. I've checked out Views->Segments which shows .text segment. It seems that I am missing out something important. It would be great if someone explained ...
- 23
0
votes
1
answer
5k
views
Binwalk to Extract Firmware is not working for me
I'm trying to extract code from Yuneec Drone Firmware and I've run into some issues. Currently when I run binwalk agains the file, I get the following issues:
binwalk autopilot.yuneec.bin
DECIMAL ...
- 11
2
votes
1
answer
256
views
Unknown archive format from QNX operating system
We are reverse engineering a QNX system and we have found a small file that is uploaded to the system. It appears to be either a file system image or an uncompressed archive of some sort. We can't ...
- 253
0
votes
1
answer
120
views
What is the best approach for using IDA's remote debugger for analyzing a sample with two VMs?
Sorry if this is a stupid question but couldnt find the answer by googling
Right now I analyze a malware by using remote debugger of IDA, and i run the debugger on a isolated VM that has shared a ...
- 222
0
votes
1
answer
82
views
Easy way to understand vulnerable functions while Reversing [closed]
I have been doing reversing lately and not an experienced Reverse engineer. Mostly I do audit on binaries both fuzzing and source code.
As I am new to this stuff, I am getting some issues of ...
- 119
2
votes
1
answer
166
views
Breakpoint in GDB hit 144 times before first call to function
I am working on a reverse engineering challenge and have a binary file. I know how to get the flag by changing the instruction flow after doing a strcmp so I jump to the function that prints the flag....
- 21
1
vote
2
answers
1k
views
Using NAND flash dump with OOB data
I have NAND flash memory dump, as a separate MTD partitions copied from NAND flash chip use built-in nanddump commands. I need to reflash some corrupted MTD partitions. In order to reflash partitions ...
- 215
2
votes
0
answers
1k
views
Extracting firmware image from binary
I have firmware file in .bin format, but I need get firmware.img image file and Kernel uImage file for reflashing bricked device. How can I get these parts?
I used Binwalk to extract content, ...
- 215
1
vote
2
answers
266
views
How to find sequence of numbers from 0-9 in a binary file?
I'd like to find a sequence of values in a 32MB data stream, where the values are all between 0x00 and 0x09 and there are about 20-40 of them in a row.
Maybe this can be done with Hex Workshop, but i ...
- 31
2
votes
1
answer
334
views
Identifying Compiler Used for Binary File
I am trying to recreate a binary file from an analysis of "strings" output. I don't recognize which compiler was used for this file. It does not seem to be shc. Does anyone recognize this output ...
- 123
0
votes
1
answer
239
views
How to identify/extract relevant assembly from a binary?
Say I was interested in reverse engineering a specific process in a large binary, say how Google Chrome parses XML, what are some general approaches to identifying the instructions that the program ...
- 125
5
votes
0
answers
117
views
JTAG Dumped Flash is scrambled
I dumped the flash memory of an old ARM9 Chip running VxWorks using the SEGGER J-Link and the savebin command from J-Link Commander.
Here is an example of a line of HTML stored on memory.
<!DOC^...
- 51
4
votes
1
answer
809
views
Radare2 ptrace can not attach
First my setup:
Linux Mint 64bit 4.15.0-20-generic
radare2 the newest version from github
/etc/sysctl.d/10-ptrace.conf = 0
Executable:
ELF 64-bit LSB executable, x86-64
read write and ...
- 191
2
votes
0
answers
125
views
Static analysis
I am working on a class project. I need to find out static features of a program (without executing it).
Backward branches (loops)
Conditional branches (potential threads with load imbalance)
...
- 121
3
votes
1
answer
239
views
What is actually loaded here and different hexdump outputs on util-linux hexdump and on cutter and ghidra's hexdump
I was trying to understand what segment of file gets loaded by fourth LOAD header on phdr array.
First 6 headers are shown below from readelf
Program Headers:
Type Offset ...
- 133
1
vote
1
answer
37
views
Confused about address being referenced
lea ebp, dword_403638
lea ebx, [ebp-4]
mov edi, ss:[ebx]
I understand the first instruction setting ebp to the address of the byte sequence. What I don't understand is what ebx will then ...
- 13
0
votes
1
answer
3k
views
how can i decrypt huawei HG531s v1 config file?
I have tried to follow this guide but
libxmlapi.so didn't have the required ATP_GetInfo1 function
so i moved to the next file libhttpapi.so
it had
ATP_GetInfo1
ATP_GetInfo2
ATP_GetInfo3
...
- 180
1
vote
1
answer
726
views
pyelftools relocation section symbols
I have been trying to get into reverse engineering as of late and after playing with Radare2 I realized I was playing with a lot of things without really understanding what I was doing. In an effort ...
- 11
1
vote
0
answers
207
views
Reproduce compilation (ASM) output for library detection - identifying compiler, version & options used
I want to reverse a stripped x86 sample that uses a static library.
So far I could identify the library itself and narrow the version of the library used.
Now I want to use Ghidra's Function ID ...
- 11
0
votes
1
answer
416
views
Understand what Ioctl do
I looking in ida on arm linux binary . I can see there that there is ioctl call
ioctl(fd,req,num).
fd is fd to /dev/module. ,req is some 4bytes and num is some number.
How can I understand what ...
- 513
3
votes
1
answer
481
views
custom virtual machine protection
How someone would go to reverse engineer a sample protected with a virtual machine? The problem is that it's not opcode anymore it's bytecode which I don't have any idea about because it's a private ...
- 163
0
votes
1
answer
139
views
What does this function actually do?
I'm taking part in this reverse engineering lab at college and we have this final big homework project. I have a part of the binary that changes it's own asm code by iterating through it's own bytes ...
- 133
2
votes
1
answer
525
views
Which file system is this? file type 0x00, folder type 0x01
Inside a internet radio firmware file I found a file system, and I don't know which one it is.
What I know:
(The first two bytes are 0A 4C (maybe magic byte))
they are actually not part of the file ...
- 125
2
votes
2
answers
800
views
GetProcAddress with 0 as lpProcName
I'm reversing a 32bit binary for a challenge I got at a college lab and I'm having a hard time trying to understand the intent of the asm code.
The binary is a 10 level reversing game where you get ...
- 133
0
votes
0
answers
922
views
unsquashfs failed to read SquashFS file
I tried to unpack binary which is SquashFS system, the file is mtd partition copied from NAND device, Root filesystem (read-only). Actually its SquashFS version, modifyed/patched by vendor.
binwalk ...
- 215
1
vote
0
answers
362
views
Using IDA to find pointer passed to procedure
Loading the source into IDA, I have this function:
According to the source for Lua, this function should be passed a pointer to the Lua_State struct:
LUA_API int lua_gettop (lua_State *L) {
return ...
- 111
4
votes
1
answer
2k
views
How to extract DVB firmware bin file?
I have a bin file of DVB (DTH) box firmware. I want to change one image inside that bin file, how I can do this? Please guide me in right direction.
I tried bin walk, but the file that it extracted ...
- 141
1
vote
1
answer
2k
views
How to find out address in binary file (like IDA) with python code only?
I have binary for example https://github.com/andrew-d/static-binaries/blob/master/binaries/linux/x86_64/nmap that I open with IDA , and search some data that I want to find without open IDA ,only ...
- 31
0
votes
1
answer
1k
views
Ida - what is Parse C header file
In ida File->Load file there is option Parse C header file, I want to understand that .
If I have the headers file that compiled with my binary I can attach and then see all the structures/function ...
- 31
1
vote
1
answer
2k
views
How to find the starting address of main function when the binary is stripped and _start doesn't push the absolute address value of main?
So let's say the ELF binary is stripped - meaning no symbol table - and the _start function doesn't push the address of main before calling __libc_start_main.
This happened in a binary when compiled ...
- 469
2
votes
2
answers
980
views
Unable to extract IP camera firmware
I am trying to extract the firmware for a Panasonic WV-S2131L ip camera. It comes as a .zip file that contains a .img file. I have tried many methods to try to analyze this file and I have found ...
- 21
4
votes
1
answer
286
views
How to find the index of static ilbrary functions in the PLT of the binary?
So right now I'm trying to resolve function calls and their names in my reversing tool
the problem I'm having is that library functions such as printf and fwrite and such do not have a corresponding ...
- 99
1
vote
1
answer
151
views
What type of function gets called using a register instead of address in the binary? how to find the address statically?
So I'm trying to write a reversing tool right now and trying to make a CALL graph
the problem I'm having is some calls are like Call *eax instead Call 'address'
I can easily generate the call-graph ...
- 99
0
votes
1
answer
421
views
How to split ARM code/data from binary in Inmarsat Isatphone Pro?
I'm analyzing the 3 binaries for updating firmware to the Inmarsat Isatphone Pro phone. Additionally, I'm following the Groundworks Technologies paper, and attempting to recreate their work as a ...
0
votes
1
answer
274
views
me_cleaner and fwupd, or manipulating UEFI .cab files
I'd like to extract a plain dump of the UEFI firmware of my laptop (1:1 copy of the flash content, often called .bin or .rom files) from the .cap file, so that I can modify it slightly with me_cleaner....
- 103
10
votes
1
answer
5k
views
Can I define custom enum-type to be used in Ghidra as a data type?
I'm trying to learn Ghidra. Say, if it generated the following code for loading functions from an array of function names from gpfnCommCtrlAPI:
I was able to retype gpfnCommCtrlAPI into char*[14] ...
- 1,487
1
vote
1
answer
344
views
Best python framework/library for constructing the call-graph from binary?
So i have written a python tool using capstone that disassembles the code section of a ELF binary using capstone.
now i want to also create and show the call-graph of this binary in a dot format, I ...
- 207
1
vote
1
answer
1k
views
View Array Type in dnSpy
I'm debugging a .NET application and see a declaration of a local array:
$ArrayType$$$BY05PAD $ArrayType$$$BY05PAD;
I break on an instruction that uses data inside that (char*) array:
num9 = <...
10
votes
2
answers
7k
views
How to load symbols from a symbol server in Ghidra?
I've been trying to learn Ghidra by attempting to reverse the comctl32.dll system library, which has many of its functions documented. I started the de-compilation analysis in it, and after a while it ...
- 1,487
1
vote
1
answer
334
views
Decryption loops
I'm reversing a CTF binary and I found a decryption loop decompiled by IDA like this:
for ( i = 0; i < n; ++i )
{
v22 = *((_BYTE *)sub_5657D89B + i);
v0 = v22 ^ 0x90;
v1 = strlen(&...
- 439
2
votes
0
answers
66
views
How do I decode arbitrary data from a raw extracted binary?
I have a IoT scale that stores my measurements into records and passes them onto my phone. I was able to read directly off a flash chip and create a binary file. The chipset is ARMv7.
I want to be ...
