Questions tagged [binary-analysis]
The process of gathering information about a binary file, either with static or dynamic methods.
111
questions with no upvoted or accepted answers
1
vote
0
answers
132
views
Unknown binary format (.scp) - No Header
I hope everyone is doing well. I've recently been trying to decode the structure of some files that contain a lot Unicode-8 IIRC characters, with a mix of binary. When I put it into IDA, I can't seem ...
- 11
1
vote
0
answers
72
views
How to find references for a string (where it is being called) in Go binary
I have a Go binary and I have this string:
When I go to its location, with IDA Pro, and tries to find all the references (using x) I am getting a message that there are no references:
It might be ...
- 583
1
vote
1
answer
861
views
Extracting Userdata from Userdata.bin file backup of oneplus 7pro mobile
I have userdata backup file (Userdata.bin) of oneplus 7pro. I want to extract photos and videos from this. when i used the command "binwalk userdata.bin" it shows
DECIMAL HEXADECIMAL ...
- 11
1
vote
0
answers
149
views
What type of file has the file signature 'BOOT'?
I have a .bin file which I am trying to disassemble into something that I can edit. Given that binary files can contain just about any binary data, I found it difficult to assess what file data is ...
- 61
1
vote
0
answers
412
views
What is .data.rel.ro used for in GO on Linux?
I'm reversing a GO binary, and I was trying to locate where some symbols appear in the binary. I did the following:
Used nm on the binary - which did not recognize any symbols
Used go tool nm - same ...
- 1,860
1
vote
0
answers
44
views
PE Format - How can I delete IMAGE_IAT_DIRECTORY and the app still runs fine?
I’m doing a small research regarding PE files and while I drilled every related question or the documentation itself I couldn’t explain this issue.
Why can I go to CFF explorer or some other PE ...
- 133
1
vote
0
answers
299
views
What to do with a text file of disassembly code and binaries?
I am fairly new to software reverse engineering and I'd like to know how proceed with analyzing a program if I have a text file of disassembly code and a bin file of binary data. I understand ...
- 11
1
vote
0
answers
141
views
dwarf: variable offset from base
I have a simple code:
int main()
{
int a = 4;
printf("%d\n", a);
a = 8;
if (a == 8)
printf("%d\n", a);
return 0;
}
DIEs for the function and variable:
<1><32a>: Abbrev ...
- 1,807
1
vote
0
answers
55
views
Main contemporary deobfuscation techniques
Could you please specify in a few words main contemporary deobfuscation techniques which we can apply to 32/64 bit PE files?
For example, (1) using instruction templates, such as:
mov edx, 5B1F04F1h
...
- 131
1
vote
0
answers
26
views
Locating Exit/Abort Functions from Static Analysis
Similar to this question, I'm interested in locating exit and abort style functions in a firmware - any function call that in fact terminates the execution, by statically analyzing the firmware.
My ...
- 1,858
1
vote
0
answers
847
views
Extract files of a SquashFS Filesystem
I already asked a similar question but after a deeper analysis of the filesystem I found out that I misunderstood the problem and that's why I decided to delete the old question and make a new one.
I ...
- 108
1
vote
0
answers
271
views
Reproduce compilation (ASM) output for library detection - identifying compiler, version & options used
I want to reverse a stripped x86 sample that uses a static library.
So far I could identify the library itself and narrow the version of the library used.
Now I want to use Ghidra's Function ID ...
- 11
1
vote
0
answers
474
views
Using IDA to find pointer passed to procedure
Loading the source into IDA, I have this function:
According to the source for Lua, this function should be passed a pointer to the Lua_State struct:
LUA_API int lua_gettop (lua_State *L) {
return ...
- 111
1
vote
0
answers
549
views
Vulnerabilities of Binary executed by root
I was given a vulnerable 64bit dynamically linked stripped that runs simple checks to determine the strength of the passwords of users on a linux system.
The app checks if it the EUID is 0 and then ...
- 11
1
vote
0
answers
194
views
Argument types not identified when parsing declarations
I'm trying to add a dynamic import segment in the IDA database which contains functions names, and I'm applying type information to it, so that I can obtain argument locations by using ...
1
vote
0
answers
300
views
How can a segfault happen during the libc exit call on Linux?
I'm relatively new to reverse engineering, and I've decided to practise using the challenges from pwnable.tw. Currently, I am working on the "Silver Bullet" challenge.
While testing, I have noticed ...
1
vote
0
answers
117
views
Is there any way to capture the state of an application so as to restore execution of it later?
There are certain older, non-DirectX-based games that I can hack inside of a VM, which is amazing because I can save snapshots of states to then restore if, say, the game crashes after I attempt ...
- 2,234
1
vote
0
answers
345
views
Naruto Uzumaki Chronicles 2 .RAW Files [PS2]
I'm have been trying to mod these game for years, but I still stuck with the raw files from RACJIN games, [same case as Fullmetal Alchemist & Bleach]. The files appear to be compressed, and a ...
1
vote
0
answers
63
views
How to make sense of this one pin serial communication
I am trying to reverse engineer a serial communication between to microcontrollers (1 device & 1 microcontroller on a board). One MCU validates the other MCU and I want to crack the validation and ...
- 111
1
vote
0
answers
345
views
Stack buffer overflow SIGSEGV help
I've been going at this for a couple of days now working through trial and error but I can't seem to pinpoint exactly why I'm still getting a SIGSEGV.
Here's the stdout of me stepping through the ...
- 153
1
vote
0
answers
2k
views
My core dump's backtrace stops to a signal handler, what can I do?
I obtained an ELF core dump that was provoked by fuzzing a proprietary server. As I do not have access anymore to the machine that hosted this server, and the server is part of a tightly coupled set ...
1
vote
0
answers
396
views
Accessing .rodata/.rel.data.ro
Analyzing an android ELF binary. How/where does something access a specific area of .rodata or .rel.data.ro? Have tried using objdump, rabin2, readelf, etc and I can't seem to figure out how it is ...
- 11
1
vote
0
answers
363
views
Analyzing Game Map/Terrain Format
I'm trying to understand how this game builds the map and terrain. Specially if it uses a heightmap. So I can write an app that can view the map and move around (camera) freely.
First, I'm not ...
- 235
1
vote
0
answers
118
views
Record-replay tools for Windows?
Are there any user-mode record-replay tools for Windows that can capture native execution of a program so that it can be replayed deterministically later? Instructions, memory accesses, syscalls and ...
- 121
1
vote
0
answers
2k
views
Modification of existing binary firmware update
I have several IP cameras from china, and I need to add some software to it. I have to ways how to burn my software into camera ROM using hardware programmer and using special binary what I upload ...
- 11
1
vote
0
answers
403
views
Why the extracted content differs?
I used binwalk to extract firmware.bin image, the extracted content is squashfs-root dir, and a separate dpc.squashfs file. Then I used sasquatch utility to extract content of dpc.squashfs file, and I ...
- 203
0
votes
0
answers
37
views
Dynamic analysis of cmd dependent software
There is a PE file, which can't run by itself, and can only be called from cmd.exe, it doesn't create independent processes, and can be launched independently only with .bat scripts, which without &...
0
votes
0
answers
52
views
Help determine 3d model vertex structure serialized binary
Help determine 3D model vertex structure serialized binary.
Example of single vertex:
A3 D0 5D BA C9 27 3F 3A DC 6C 87 3B 2B 75 EE 00
FF FF FF FF 92 2F 29 80 B1 19 64 3F 02 82 1D 3F
What I got so far:...
- 1
0
votes
0
answers
60
views
Help Extracting a CramFS filesystem from .img binary
I'm trying to extract a CramFS filesystem from a firmware binary for the FVS318Gv2. It downloads as a .zip file that can be decompressed to reveal a firmware .img file and a readme.htm. Running ...
- 1
0
votes
0
answers
64
views
Decompile or analyse injected /usr/bin/cat
I'm trying to decompile or analyse an injected Linux executable binary file /usr/bin/cat ,and find the injected code as a readable.
Need some tips as a beginner how to find the injection method if it'...
0
votes
0
answers
43
views
Unknown Mitsubishi automotive MCUs - are these using unknown architecture?
Please help ientify the architecture (ISA) of MH8200F and MH8110F which is found almost exclusively on Mazda ECUs with L3CK, L587, L5E8, LFAR, LFFR, LFJP firmwares
I've revealed that the MH8501F is ...
- 1
0
votes
0
answers
458
views
Hello Watch 3+ smart watch firmware extracting
I have a firmware file of Hello Watch 3+ smart watch. I want to customize this firmware. I tried binwalk but no result. I am trying reverse engineering for the first time. Can you help me?
File link: ...
0
votes
0
answers
67
views
Requesting Guidance To Understand SuperScape's .VCA Format: Lego Creator Knights Kingdom
I hope you all are doing well and staying safe.
I am in the process of trying to understand how SuperScape stored data in their .VCA/LCA format, so I can extract the original SHAP and PAL data from ...
- 1
0
votes
0
answers
31
views
Why can't I resolve the 'system' dynamic addresss in ret_2_libc exploit?
First and foremost, I am a noob pwner. The problem at hand is from TryHackMe.com > pwn101 > pwn109. A simple ret_2_libc in which you exploit a simple buffer overflow, leak the addresses of gets()...
0
votes
0
answers
27
views
Why would unreadable data recovered from a drive be non-recoverable?
I ran Disk Drill on a drive that was a member in a failed software RAID mirror on macOS. The drive seemed to be fine, but was showing up as "uninitialised", so the drive didn't fail as such ...
0
votes
0
answers
194
views
Need Help Cracking a Program
So I've got this .exe that I want to crack. It's an old management system for people in truck loading business.
I kind of understand what's happening with window API calls but I'm unable to access the ...
0
votes
0
answers
257
views
Need help in opening of binary files
Need help with unreadable Far Cry 6 binary format (.spx)
Hi everyone, name is Adi :-).
For the past few weeks I've been searching for a solution to a problem that the Far Cry Modding Community with me ...
- 1
0
votes
1
answer
210
views
How to pass an SVD file as an argument to IDA Pro in the command line (batch mode)?
I am trying to disassemble a few Arm Cortex-M3 .elf binaries and run a custom IDAPython script (script.py) from the command line (in batch mode). I have been able to do that with the following command:...
0
votes
0
answers
99
views
How do I properly decode the .bin files (RLE compression)? (DOS game - 1988)
Does anyone know what tools should I use to extract the backgrounds and sprites of this very rare old game: Armorik the Viking?
The files are in .BIN format. Compression is RLE
The game is from 1988 ...
0
votes
0
answers
318
views
Reverse engineering STM32F303 firmware udpate
I have an .exe file, which connects via USB to a STM32F303 peripheral with unknown firmware. The .exe is able to update the STM32 firmware via the USB. The firmware update is also provided, and its ...
- 41
0
votes
0
answers
297
views
How do I view registers at a specific point of a binary's execution?
I have a binary that I'm attempting to reverse engineer to find a flag. From using ghidra I have found that the flag is stored in the program at a point called "check" and then run through ...
0
votes
0
answers
526
views
Extract smartwatch firmware bin file
I'm trying to extract files from a bin file that's the firmware of a smartwatch.
I tried using
binwalk -Mre firmware.bin
but got no files, this is the result:
How should I extract/modify this bin ...
- 1
0
votes
0
answers
248
views
How to Find Password/ Bypass Password in a Switch Statement using IDA
I'm new to reverse engineering, wondering how access or bypass the password contained in the switch statement ?
File Link
- 1
0
votes
0
answers
58
views
IDAPython NtCreateFile
Let's say I want to print the filenames on every call to NtCreateFile
(With %any% exe loaded in IDA )
The first problem is to get the ntdll!NtCreateFile address
Tried to do it like this ...
- 1
0
votes
0
answers
97
views
finding a not-so-straightforward game's function
I am working on Mad Max game [ APEX engine ]
I do my best to explain the situation.
so my target executes function like this:
there are commands like " call [eax+XX] " or " call RX &...
- 51
0
votes
0
answers
93
views
Radare2: Running executable from a specific point
I am using radare2 to reverse engineer a standard crackme executable. I have obtained the password, but now I need use the program to read & print a restricted file to which the executable has ...
0
votes
0
answers
198
views
String as constant , even not visible in disassembler
I was reading this article Where I saw that while reversing the WinRAR I saw that the x64dbg is not able to search for a string in all modules "evaluation copy". but why is that happening. ...
- 143
0
votes
0
answers
1k
views
Modify Strings in a ELF (Executable and Linking Format) that are stored in the .rodata
I have 2 ELF files here, each containing strings in the ".rodata" for an translation that I want to modify.
The first ELF "(binary1)" I have already successfully modified from ...
- 83
0
votes
0
answers
595
views
Combine two ELF binaries
Without having access to the original source code, is there a way to combine two ELF binaries with the main() in the first binary pointing to the main() in the second binary ?
In other words, I mean ...
- 156
0
votes
0
answers
122
views
Jump without jmp near
I need to jump a
Hello,
I need to jump some lines that lock program in a loop status.
i use process hacker to find lines with string in binary but when i find this lines i have not jumps near, in ...
- 1