Questions tagged [binary-analysis]

The process of gathering information about a binary file, either with static or dynamic methods.

Filter by
Sorted by
Tagged with
0
votes
1answer
323 views

reverse engeeneering the 3d file of a game [closed]

I have a problem to find out how to open a file of a game this one seems to have encrypted its files. Currently all I know about the file is that it seems to be a custom 3D file. here is the file ...
1
vote
1answer
518 views

How to add new language to ARM firmware

I have piece of firmware (download from here) and I need to get access to its filesystem. Here is the output of a binwalk scan: root@kali:~/Desktop/E1200YDXNB1_OLAANB1# binwalk --dd=".*" ps.bin ...
2
votes
1answer
906 views

No apparent entry point for stripped, PIE binary using radare2

I am running on 64-bit Windows 7 and am using radare2 to attempt both static and dynamic analysis of a binary executable. The issue is that I cannot seem to find the entry point of where the program ...
0
votes
1answer
74 views

Where Is device specific information kept on smart devices

I am doing a project for school on Emulation of device using its firmware. Using firmadyne, I can start up the smart device unfortunately because it is not a real device, information fields like ...
1
vote
1answer
2k views

Binwalk could not extract the full content

Binwalk v2.1.1 on Ubuntu, and tried to research Zyxel Router firmware. First I unzipped FW, there was 3 files: 360AUG0C0.bin, 360AUG0C0.rom, AUG107.bm I used binwalk to extract content of bin file, ...
2
votes
2answers
702 views

Identification of D-Link firmware checksum and adding it to OpenWrt firmware

I have this D-Link firmware and would like to identify checksum type used on it and add it to OpenWrt bin file so I could upgrade firmware to OpenWrt instead default crappy D-Link. I did tried to ...
5
votes
2answers
322 views

Flare-ON#3: Problem understanding some parts in the program

I was trying the flare on challenge. When trying the challenge#3 I got into some trouble and could not solve it. After looking into solutions wrote by other I now do know how the program works, but i ...
2
votes
1answer
622 views

Strange instructions pattern (lw) in MIPS binary

I'm trying to reverse a binary and I'm having trouble understanding a pattern that keeps showing in almost half of the functions in the binary. This is how one particular function looks like: Why is ...
1
vote
1answer
902 views

Rebuilding firmware back to binary file

I used Binwalk to extract firmware files, extracted content include 2 folders and one binary file. squashfs-root _351C.extracted 351C Squashfs-root contains file system, '_351C.extracted' folder ...
5
votes
3answers
919 views

Changing a windows name by patching create window function call

I use x64dbg and IDA Pro the process is 32bit. I'm not sure if I'm doing this right or not because I'm getting a crash which I'm not sure if it's caused by me doing something wrong or the startup ...
1
vote
0answers
266 views

Stack buffer overflow SIGSEGV help

I've been going at this for a couple of days now working through trial and error but I can't seem to pinpoint exactly why I'm still getting a SIGSEGV. Here's the stdout of me stepping through the ...
3
votes
1answer
9k views

Import table vs Import Address Table

What's the difference between the Import Table and the Import Address Table?
4
votes
1answer
2k views

Reverse Engineering Windows PowerBuilder Binaries

I recently stumbled across a binary file built using Sybase PowerBuilder 12.5 and I am looking for any assistance in reversing it as it's actually quite different than a typical C++ binary. I'm ...
-1
votes
1answer
459 views

Shells CTF segfault - wrong address

PicoCTF 2017 Shells I have a binary and source: #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <sys/mman.h> #define AMOUNT_OF_STUFF 10 //TODO: Ask IT ...
0
votes
1answer
2k views

Unpacking firmware

I have a ROM dump firmware which must be reversed (as a task). Binwalk output: DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------------------------------------...
-3
votes
1answer
1k views

what does VA and OEP means? and How does IAT be fixed manually? [closed]

in the context of reversing a packed binary, what does VA and OEP means? and How can IAT be fixed manually?
0
votes
1answer
494 views

Unpacking ROM dump

I have a ROM dump from an unknown controller, which must be reversed (as a task). It looks like encrypted, packed or obfuscated. Binwalk did not give any information("cisco os experimental microcode ...
1
vote
0answers
947 views

My core dump's backtrace stops to a signal handler, what can I do?

I obtained an ELF core dump that was provoked by fuzzing a proprietary server. As I do not have access anymore to the machine that hosted this server, and the server is part of a tightly coupled set ...
1
vote
1answer
1k views

How can I convert a .bin file to either assembly or C?

I have a .bin file (It's a firmware belongs to a hardware (Cisco Access-Point) ). All I need to do is modifying that .bin file. As you know, .bin files aren't human readable. I need to convert it to ...
3
votes
2answers
375 views

Track execution of bytes in a Linux executable

Given a binary executable file (in this case, a compiled C file which finds the gcd of 2 numbers), is there a tool which profiles the execution of this file and could generate some sort of call graph ...
1
vote
1answer
212 views

possible to get reference assembly address in file for special memory address?

Hello I try to learn reverse engineering, so i use from process hacker to view dynamic strings in the process's memory... (more info) i get something like this : Address Length Result --------------...
0
votes
1answer
92 views

Gaps between sections

After analyzing some binaries, I noticed that the sections, .text, .data, .bss, etc, are not really adjacent. It seems to be a gap between them, why is that?
0
votes
1answer
149 views

How can I tell if a virus was made by Russians? [closed]

I have been looking around quite a bit on the internet for something that could tell me more than basic section on a binary. I have a PE file and usually I see just what compiled it (MSVS or GCC ... ...
2
votes
1answer
711 views

File analysis with hexdump - unknown container

I have a backup file, generated by an android phone. However, I don't know the file type or how to extract the contents without the original software. I've tried to search for common file headers ...
5
votes
1answer
1k views

OLLYdbg is stopping on 7000000 addresses on the ntdll and not the entry point of the application

i am solving the leena's 4th binary challenge.but the ollydbg is unable to stop at Entry point which some around 400000 or above.Application stops working and start with some around 700000 check the ...
1
vote
1answer
2k views

reversing stripped & statically linked binary with radare2

As the question says I need to reverse a stripped elf binary with radare2. This binary is also statically linked. I already reversed it in IDA by identifying statically linked libraries using lscan ...
1
vote
2answers
2k views

binwalk on reversing switch firmware

everyone. I am a green apple in reversing. Recently i wanna reverse a switch but get some problems. i reaaaaaaaaly need your guys help. first i extract the .bin file from the switch and use binwalk ...
3
votes
3answers
5k views

Speedport entry 2i zte home router's firmware

I was searching through my routers admin page some time ago and I've noticed that it doesn't support firmware updates by the user(it's an ISP's speedport entry 2i router(zte variant)). So long story ...
1
vote
1answer
199 views

Finding variable reference in cpp

Let's bring example We have string 0000000000bd2906 db "CurrentKey", 0 ; DATA XREF=sub_555670+3390 And it's used here 00000000005563ae lea rsi, qword [0xbd2906] ; "CurrentKey" Disassembler ...
2
votes
1answer
2k views

Disassembling MIPS 32 version 1 binary with the Radare2 Framework

I am trying to disassemble a MIPS 32 version 1 binary with the Radare2 framework. Here is the full output of the file command: ELF 32-bit LSB executable, MIPS, MIPS32 version 1 (SYSV), dynamically ...
6
votes
1answer
4k views

How to make radare2 work for a large binary?

I compiled cpython with debugging headers and I want to perform the following analysis using radare2. The problem I encounter is that it takes forever (at least 27 hours) to perform the aaa (...
16
votes
4answers
9k views

How to generate the call graph of a binary file?

I have a non-stripped ELF binary for which I want to create a call graph as a dot file. Is there such a tool which generates the call graph? EDIT: Is there away in addition to the conventional call ...
1
vote
2answers
247 views

How to monitor specific variables in a running process?

I would like to monitor, record, specific variables in an application but I am not sure what is the right way to approach this problem. The application is a mix of C(5%) and C++(95%) and it is ...
0
votes
1answer
201 views

Can anyone help me identify and decode this string? [closed]

Below is a part of a code that I reversed with repy2exe and I want to understand what it does and especially how to decode the value in the "secret" variable: using = [ 'Mg==\n', 'MTA1\n', ...
0
votes
1answer
1k views

Need help with binary file analysis

So I'm currently trying to analyze a resource archive file of an old game. What I got so far The file is supposed to represent a "virtual drive", the format is called VDRV. This means there are ...
2
votes
1answer
2k views

Decoding binary data structure

I have these data files that are generated by a tool which was distributed by a company that is long defunct. I have been taking it apart with a binary file viewer (freeware from Proxoft, it is a ...
1
vote
1answer
226 views

How can I debug this binary (which I suspect does encryption)?

I have a snippet of binary code which performs some encryption algorithm (most likely modified RC4). I have four variables associated with the encryption (seed_key_arg [1-3] and a seed_key) and ...
1
vote
1answer
853 views

Could not find ld-linux-x86-64.so.2 in strace output

I did a ldd on /bin/cat and I see that dynamic loader library /lib64/ld-linux-x86-64.so.2 is a part of it. ldd /bin/cat linux-vdso.so.1 (0x00007ffe743f4000) libc.so.6 => /lib64/libc.so.6 (...
0
votes
1answer
66 views

How to find out where an application stores the resolutions it allows?

Many applications (in particular most games) offer a set of resolutions to choose from. Some of them are pretty open and allow basically every resolution the underlying system seems to be capable of, ...
1
vote
1answer
7k views

Need help extracting JFFS2 filesystem from .img firmware binary

I'm trying to access the filesystem of the EA2750's firmware. Here is a link to download it http://downloads.linksys.com/downloads/firmware/FW_EA2750_1.1.7.172380_prod.img. The problem is it is an img ...
1
vote
0answers
274 views

Accessing .rodata/.rel.data.ro

Analyzing an android ELF binary. How/where does something access a specific area of .rodata or .rel.data.ro? Have tried using objdump, rabin2, readelf, etc and I can't seem to figure out how it is ...
-1
votes
1answer
366 views

Disassembling code with Hopper

I'm trying to figure out what this code is doing. The first thing that I don't understand is the condition that tests if arg0's value is 0x2. I read that 0x2 in ASCII is STX (Start of text). Here's ...
1
vote
1answer
1k views

How to convert the dumped firmware (from linksys-wrt54gl via JTAG port) in an understandable format

Issuing some commands for the dumped firmware: $ du -h fw.bin 4.0 M $ file fw.bin fw.bin: data $ file -i fw.bin fw.bin: application/octet-stream; charset=binary $ binwalk fw.bin - $ enca -L none ...
1
vote
2answers
2k views

newbie trying to understand disassembled code

I have been writing small C programs and then disassembling them to try to understand what is actually happening under the hood. I am using mingw-w64 on Windows 7 for my work, and I have run into a ...
5
votes
1answer
435 views

How can the problem posed for disassembly by the admixture of executable code and literal pools in ARM firmware be overcome?

It's probably too soon for me to ask about this since I'm not familiar with ARM but it's been bothering me for a while now so I'm going to ask anyway. Context and Background Information Part 1: ARM ...
6
votes
3answers
3k views

Running a binary identified as an ARM excutable by binwalk --disasm

I have a Philips 10FF2 picture frame I'm trying to reverse engineer. In the firmware download from the Philips website (http://download.p4c.philips.com/files/1/10ff2cme_00/10ff2cme_00_fus_aen.zip) I ...
2
votes
1answer
263 views

Trying to reverse engineer teamviewer's printer driver

Unlike LogMeIn or GoToMyPC, TeamViewer does not have any driver files except for the INF and GPD files. LogMeIn and GoToMyPC have their own configuration and driver dlls, while TeamViewer uses the ...
1
vote
1answer
1k views

Trying to identify a string in a strcmp instruction

Working to debug and analyze a piece of firmware, I've come across a bunch of cgi files which are all symlinked to a central cgi file. The first thing the main function does is run a series of string ...
1
vote
1answer
7k views

Reverse engineering binary file to find flag

The binary is from here: https://files.fm/u/qtqmhhdd I've been attempting this a couple of days. Its an ELF-64 bit file and I've gdb and IDA to see how it works for a while. You can run the file by ....
3
votes
2answers
267 views

Problem with converting hex values to decimal

I'm reverse-engineering custom binary file format. I'm using 010 Editor to check this file. I found data structure to represent UTF-8 strings, which has header section of one or two bytes in length ...

1
3 4
5
6 7
9