Questions tagged [binary-analysis]

The process of gathering information about a binary file, either with static or dynamic methods.

Filter by
Sorted by
Tagged with
3
votes
3answers
815 views

Finding end of file

I have got a file which contains other files. I know where the subfiles start (header) but how do I know where the subfiles end ? Edit: Files are like: sound files (.wav) and images (.bmp, png, jpeg) ...
12
votes
2answers
9k views

Why I can not directly get the content of `.bss` section?

Test is on Linux 32bit. I use this command to get the context of .text .rodata and .data section: objdump -s -j .text elf_binary objdump -s -j .rodata elf_binary objdump -s -j .data elf_binary But ...
4
votes
4answers
1k views

Tools to show the registers and memory locations in use during execution?

I am looking for something that is like gdb but maybe with a GUI that can show all registers current values ans the current values of memory and things on the stack? Freeware is preferred. I have a ...
1
vote
2answers
606 views

What is the address of main() and how many bytes does it allocate on the stack for its frame size?

Here is my objdump -d output but I do not know where to look. I understand assembly but it is a little confusing trying to find out what the values of registers are at certain points. If anyone knows ...
1
vote
1answer
758 views

Cannot find the caller of the main function in a disassembled firmware

I am looking at an unstripped ARM elf firmware file using IDA Pro. There is an init() function and a main() function. From my understanding of the logic, it's probably structured like this: init() ...
5
votes
1answer
4k views

Find the C++ STL functions in a binary

I have a binary file (actually, an operating system for an ARM embedded device which also contains some high-level apps (hard coded in the user interface)). I know some parts of the operating system ...
1
vote
1answer
259 views

Directed call inside recv

In tracing how the recv function works on Windows, I observe the following trace: ... 0x743817d2 push eax C:\windows\system32\WSOCK32.dll recv 0x743817d3 ...
3
votes
1answer
432 views

Trouble analyzing a ransomware

I got this fake-av sample , and I want to reverse it . But the problem is that it exits after few commands . Here are the steps : When loaded in Ollydbg it pauses at: 00401000 > $ 8D9404 7713210&...
5
votes
1answer
673 views

Why is true emulation not possible?

Antiviruses and similar analysis engines often face the problem of identifying whether the file is harmful. They often do so with the use of (partial)emulation and as a result often fall prey to the ...
6
votes
1answer
978 views

I need quick correction on this x86 opcode conundrum

I am trying to figure out how to encode the instruction MOV DS, AX, but I am confused from the opcode table as follows: Is MOV DS all one byte, or is MOV one byte, DS the second, and the AX the third?...
-4
votes
1answer
667 views

what is the best debuger for firmware router ? [closed]

down vote favorite i need debugger for firmware router ,i work in security of firmware so when i have firmware for router or other machines but i need to debug this firmware , so i need firmware ...
2
votes
2answers
1k views

SJ1000 ActionCam firmware

I want to modify the mentioned camera firmware (SJ1000). The binary (.bin) firmware file can be downloaded from archive.org. I used binwalk to scan the binary, but I'm stuck. The binwalk signature ...
1
vote
3answers
563 views

What exactly do assemblers translate macros into?

I have dug in simple binaries, such as though like x86 bootloaders, Sega video game binaries, etc. I know that these files tend to use assembler macros to define data, etc. What I am having trouble ...
-3
votes
1answer
178 views

Is there always 1:1 correlation between hexadecimal and binary?

I was wondering this because I have found that some instructions, on the machine code level, are too large if taken a step down from hex to 0s and 1s. On Motorola 68000 I found that some instructions ...
3
votes
1answer
1k views

Difference Between Binary Exploitation and Reverse Engineering?

I am a beginner in Reverse Engineering and am trying to improve my skill by participating in any CTF's I can and solving CrackMe's. I am trying to find out why Binary Exploitation and Reverse ...
10
votes
1answer
793 views

Static analysis data combined with dynamic analysis knowledge

What I'm doing now is placing an awful lot of comments about function variable values, global variable values as comments in my IDA database, which I find ugly after a while and obviously not a best ...
7
votes
4answers
2k views

Is there any tool to quantitatively evaluate the difference of binary?

I know some binary diff tool like VBinDiff and others. Currently I have a large number of binary, around 500. So I am looking for a binary tool to quantitatively evaluate the difference of binaries.....
1
vote
2answers
4k views

How to find how global variables defined in binary

In Visual Studio I have written simple code, int pranit = 2; int& sumit = pranit; int main(int argc, char** argv) { sumit++; return sumit; } I used OllyDbg to Disassamble, but I am not ...
16
votes
3answers
6k views

Parsing/Rescuing corrupted IDA database

I'm reversing an application with IDA. My VM crashed and left the IDA database in a corrupted unpacked state. The next time I tried to load it back, IDA gave me the following error message: The ...
2
votes
1answer
343 views

What is the format of this date time?

I've been writing a small library to allow parsing of the data files used by Sage Accounts 50, but I'm really confused by how it is storing dates. I'm fairly sure that there will be a date created ...
48
votes
7answers
114k views

How to know in which language/technology program (.exe) is written?

How to understand if exe/dll is written in C++/.Net/Java or in any other language. I tried to use Dependency walker but not able to get required information.
2
votes
1answer
1k views

IDA Pro only recognizes my files as BINARY

I am trying to disassemble some various files, and IDA does not recognize them. Is there anyway to add more file types to IDA Pro? I am running ida 6.5
5
votes
3answers
4k views

Is learning assembly enough to become a malware analyst? [closed]

I am a C/C++ developer and I have started learning assembly language programming with the goal to become a malware analyst. I know it is not enough to just know how to read assembly to become a ...
-5
votes
2answers
1k views

Bin file is not only storing 0s and 1s, ASCII or otherwise

Upon checking out a binary file, and according to convincing evidence, .bin file extensions are supposed to denote a file type which stores its data as 0s and 1s, or 31/32 in ASCII hex(ASCII character ...
4
votes
1answer
296 views

Reverse engineering in pairs - is it possible?

I'm interested if anyone can share from his experience how to analyze complex binaries in pairs - 2 RE engineers. Are there any suitable methodologies, tools to help in such work? UPDATE This is ...
5
votes
1answer
2k views

IDA Pro for MIPS image

I have this file: [ytti@lintukoto ~/tmp/ida]% file cat3k_caa-universalk9.SPA.03.03.00.SE.150-1.EZ.bin cat3k_caa-universalk9.SPA.03.03.00.SE.150-1.EZ.bin: data It's image for Cisco Catalyst 3650 ...
8
votes
2answers
2k views

Decoding an ancient format

It's a very interesting file format may greatly satisfies binary archaeologists. sample file Background This file format was created in 90s to archive customer created AutoCAD components library ...
2
votes
2answers
3k views

Decoding a blob

I have a proprietary file format that is a compressed database file. This database file has a few dozen tables. Each of these tables only have a few records, many of them don't have any records at all....
21
votes
6answers
6k views

Tool or data for analysis of binary code to detect CPU architecture

Assuming that I have binary file with code for unknow CPU can I somehow detect cpu architecture? I know that it depends mostly on compiler but I think that for most of CPU architectures it should be ...
6
votes
3answers
5k views

unpack Clear spot .bin firmware update

I am trying to unpack a clear spot firmware update The firmware I am trying to reverse can be found on the download page of the vendor I have used the fwtools to unpack the firmware as described on ...
12
votes
3answers
6k views

Totally unknown file analysis approaches

I guess this is the worst case. I have a file which was initially base64 encoded. This step was easy. But now all I can see is a bunch of rubbish. No structure, nearlly a maximum of entropy, no ...
3
votes
1answer
1k views

Recreating 2D aspects of Cantor.dust

I'm trying to recreate some of the 2D capabilities that were demonstrated in cantor.dust, I was wondering if anyone knows how they translate a large file(executable) into a number of different images /...
9
votes
2answers
1k views

Binary instrumentation with Python

I'm interested in performing (dynamic) binary instrumentation using Python to be able to analyze the binary by instructions during execution for Windows Linux Can someone suggest such tool/framework?...
4
votes
1answer
3k views

How to reverse command line arguments?

I am working on a console windows executable. So far what I figured out is that the executable checks number of command line arguments. Afterwards, it branches out depending on the number of arguments ...
13
votes
2answers
16k views

Extract SquashFS filesystem with shsq magic number

for a few days I was trying to extract the filesystem of a router firmware. Checking the image that the vendor provides I can see a SquashFS flag on it: DECIMAL HEX DESCRIPTION -----------...
15
votes
2answers
4k views

Why are GOT and PLT still present in Linux static stripped binaries?

I am looking at statically linked linux x86 stripped binary. I noticed that there are .got and .plt sections. I wonder what does a statically linked binary need got and plt sections for ? Anyone ?
4
votes
1answer
3k views

Find file signatures inside an unknown file

I have a .bin file I would like to analyse. Especially find images embedded in this firmware update. binwalk couldn't find anything. What other tools do you know to search for possible embedded ...
5
votes
2answers
371 views

Find level data in binaries?

I am trying to recreate an old game just for the sake of nostalgia and learning something new alongside (I can program in various languages and know a bit of assembly language, but I'm new to reverse ...
6
votes
4answers
18k views

Is there any tool for decompiling raw binary files to C code for the Motorola 68000 processor series?

I have the ROM dump (.bin files) targeted for the MC68008 processor. Need to convert them into a high level source code. I have already found tools for disassmbling them into assembly code. The next ...
5
votes
4answers
2k views

Is BinNavi available? If not, can I get the source from anywhere?

BinNavi is originally a Zynamics product. But, since the company has been bought by Google, it seems to be difficult to get the library. I tried to look in the BinNavi manual in the installation ...
101
votes
2answers
78k views

What is PLT/GOT?

From time to time, when disassembling x86 binaries, I stumble on reference to PLT and GOT, especially when calling procedures from a dynamic library. For example, when running a program in gdb: (gdb)...
4
votes
1answer
606 views

On SPARC, what happens when a branch is placed in the branch-delay slot of another branch?

Our team recently had to look at SPARC assembly specifications, the problem is that I do not have a SPARC processor to try things on it (I should set up a simulator or get one of these old Sparc ...
13
votes
5answers
1k views

How do you store your data about a binary while performing analysis?

Since now, when I am analyzing a binary, I'm using a "pen and paper" method to locate the different location of the function, the different type of obfuscations, and all my discoveries. It is quite ...
52
votes
7answers
28k views

how can I diff two x86 binaries at assembly code level?

I'm looking for a tool like Beyond Compare, meld, kdiff, etc. which can be used to compare two disassembled binaries. I know that there's binary (hex) comparison, which shows difference by hex values, ...
10
votes
1answer
3k views

What are the main features of radare2?

Radare2 is a framework for reverse-engineering gathering several tools (see this Phrack article about radare1 to know a bit more about the framework). I would like to know if someone could point out ...
9
votes
1answer
1k views

What are the differences between BitBlaze and BAP?

BitBlaze and BAP are two platforms to perform binary analysis. And, if I understand well, they are sharing lots of common features. What are their respective main features and in what do they differ ...
21
votes
4answers
6k views

What is “overlapping instructions” obfuscation?

I analyzed some binaries in x86/x86-64 using some obfuscation tricks. One was called overlapping instructions. Can someone explain how does this obfuscation work and how to work around?
11
votes
3answers
7k views

Reverse engineer an old DOS QBasic executable

I recently decided to try my hand at reverse engineer an old DOS text based game that was coded in QBasic. I found some info online about old DOS games disassembly but mostly for Wacom compiled C/C++ ...
4
votes
1answer
245 views

What is the scalability of state of the art static binary analysis techniques?

What is the largest program that has been analyzed by a semantics-based static binary analysis? By semantics-based, I mean an analysis that examines the meaning of the program, and does not simply ...

1
5 6 7 8
9