Questions tagged [binary-analysis]

The process of gathering information about a binary file, either with static or dynamic methods.

87 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
0
votes
0answers
27 views

Nokia 105(TA-1114) Firmware analysis using Binwalk

First please forgive me if a make any mistake. i am not a primarily English speaker but I will try my best. Few days ago i started to tinkering with Nokia feature phone Nokia 105(TA-1114). I get a ...
0
votes
0answers
60 views

Help to find the main menu apps in Nokia firmware

I am trying to custom Nokia 215 4G firmware I want to remove specific apps like games, radio, browser... If not removing it, redirecting it OR even damage it. So when you click on an app it will open ...
0
votes
0answers
29 views

What type of file has the file signature 'BOOT'?

I have a .bin file which I am trying to disassemble into something that I can edit. Given that binary files can contain just about any binary data, I found it difficult to assess what file data is ...
0
votes
1answer
28 views

The Logic Of Incremental Data on Serial Communication Encoding

These are the serial communication reverse values. I am trying to understand the logic behind this. I am pretty sure that 2 bytes represent 1 byte(high byte and low byte), values are correct. I tried ...
0
votes
0answers
42 views

Understand the AES encryption mode

I am reverse engineering a software that implements its own encryption over HTTP. The implementation is very simple, the client has the server's public key which it uses to encrypt the data it sends ...
0
votes
0answers
62 views

How to Find Password/ Bypass Password in a Switch Statement using IDA

I'm new to reverse engineering, wondering how access or bypass the password contained in the switch statement ? File Link
0
votes
0answers
31 views

IDAPython NtCreateFile

Let's say I want to print the filenames on every call to NtCreateFile (With %any% exe loaded in IDA ) The first problem is to get the ntdll!NtCreateFile address Tried to do it like this ...
0
votes
0answers
49 views

Control flow graph of entire binary file

Is it possible to get the control flow graph of the entire binary file using any disassembler? IDA Pro generates the CFG for each function. Can we use it to get the CFG of the entire program?
0
votes
0answers
45 views

Possible ways to reverse enginerring the boot file

I am trying to take files from the file called LOADING.KWI it is the boot file for multimedia, located on the loading sdhc card, which should be inserted in multimedia's slot, without this card the ...
0
votes
0answers
61 views

finding a not-so-straightforward game's function

I am working on Mad Max game [ APEX engine ] I do my best to explain the situation. so my target executes function like this: there are commands like " call [eax+XX] " or " call RX &...
0
votes
1answer
61 views

How to export arm64 and x86-64 binary into one?

I am trying to export a binary that contains both AARCH64-64 and x86-64 in Ghidra. I only opened the x86-64 counterpart to perform some changes. When I tried to export it, it exported a .bin file that ...
0
votes
1answer
114 views

Advanced Binary Exploitation CTF

I wanted to ask your assistance: Where can I find advanced ctfs (that hopefully contain solutions) regarding binary/kernel exploitation? I am interested on finding x86_64 linux/windows/arm64 that ...
0
votes
0answers
35 views

What is .data.rel.ro used for in GO on Linux?

I'm reversing a GO binary, and I was trying to locate where some symbols appear in the binary. I did the following: Used nm on the binary - which did not recognize any symbols Used go tool nm - same ...
0
votes
0answers
35 views

Bypassing debugger detection in radar2

I'm currently doing a reversee engineering challenge. I disassembled the ELF binary in radare2, however the binary checks whether its attached to a debugger. How can i bypass this detection ? Thanks ...
0
votes
0answers
33 views

Issue Debugging in IDA PRO

I am analyzing a binary file to retrieve the password. It requires a userID and password. By analyzing I need to crack the password. But after running through IDA it is being terminated. First, I used ...
0
votes
0answers
103 views

How do reverse-engineers feel comfortable with not knowing the 'big picture'?

One of the biggest barriers in my journey of learning reverse-engineering seems to be the fact that I feel rather uncomfortable being confused about the 'big picture' of what I am reversing and not ...
0
votes
0answers
79 views

Unpack old DLink DIR-855 firmware

I'm trying to reverse engineer an old firmware of the D-Link DIR-855. The latest binary can be found here: ftp://ftp.dlink.de/dir/dir-855/driver_software/DIR-855_fw_reva_124eub01_ALL_multi_20130614....
0
votes
1answer
63 views

Getting the object name through the Ghidra Script

I have a script written to work with ghidra. I am doing some analysis in the script and save the results in a file. Right now, I am passing the name when a prompt ask the file name to save upon ...
0
votes
0answers
135 views

Alternative to BinDiff that works on Linux x86_64 binaries (and preferably does not require IDA Pro)

Is there alternative to https://www.zynamics.com/bindiff.html that works for Linux x86_64 binaries, works on Linux, (and preferably does not require IDA Pro, however if needed it seems that IDA can ...
0
votes
0answers
62 views

binwalk not showing file descriptions (signatures) after 1st try

I have a bin file that shows a list of lzma compressed files which I extracted generically to .7z files using this format "binwalk -D "elf 32-bit lsb shared object":.so image.bin" ...
0
votes
0answers
34 views

Radare2: Running executable from a specific point

I am using radare2 to reverse engineer a standard crackme executable. I have obtained the password, but now I need use the program to read & print a restricted file to which the executable has ...
0
votes
0answers
47 views

String as constant , even not visible in disassembler

I was reading this article Where I saw that while reversing the WinRAR I saw that the x64dbg is not able to search for a string in all modules "evaluation copy". but why is that happening. ...
0
votes
0answers
274 views

Modify Strings in a ELF (Executable and Linking Format) that are stored in the .rodata

I have 2 ELF files here, each containing strings in the ".rodata" for an translation that I want to modify. The first ELF "(binary1)" I have already successfully modified from ...
0
votes
2answers
149 views

What should I learn in order to reverse elf64 binary files

I'm a little confused. I am using a Linux based system (Ubuntu), 64-bit. and I want to start and reverse 64elf binary files, but there is a lot of things I want to know before. just to be clear, If I ...
0
votes
0answers
58 views

Combine two ELF binaries

Without having access to the original source code, is there a way to combine two ELF binaries with the main() in the first binary pointing to the main() in the second binary ? In other words, I mean ...
0
votes
0answers
63 views

Jump without jmp near

I need to jump a Hello, I need to jump some lines that lock program in a loop status. i use process hacker to find lines with string in binary but when i find this lines i have not jumps near, in ...
0
votes
0answers
240 views

reversing xiaomi update firmware encrypted?

I am playing around with a xiaomi firmware [mijia_4k_0.6.16.02] for a camera Running binwalk on the file I see this output DECIMAL HEXADECIMAL DESCRIPTION ----------------------------------...
0
votes
0answers
94 views

Tools for statistical analysis of binary streams

I'm in the process of decoding the semantics of an unknown binary stream1. I've come to a point where I understand the overall structure: A tag byte, followed by a size field, and a blob of bytes of ...
0
votes
0answers
153 views

How can I find loading adress of eCos firmware

From:https://www.tendacn.com/en/download/detail-3482.html Im trying to find loading address (entry point of my program) for this binary, which is part off this firmware. Im trying to load it inside ...
0
votes
0answers
55 views

Is there a way to see 'imports' in a .NET binary?

Programs such as Detect It Easy or IDA can show functions and libraries (DLLs) imported by a binary in the case of C/C++ binaries. I have a collection of .NET malware that I'm analyzing and would like ...
0
votes
0answers
487 views

unsquashfs failed to read SquashFS file

I tried to unpack binary which is SquashFS system, the file is mtd partition copied from NAND device, Root filesystem (read-only). Actually its SquashFS version, modifyed/patched by vendor. binwalk ...
0
votes
0answers
171 views

What is this function doing?

I have this function, named __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6__initEPKcm. And this is the relevant assembly: mov rdi, [rbp+var_A80] mov rsi, [rbp+var_A88] ...
0
votes
0answers
111 views

Locate compressed section of executable

I am playing with Philips DICOM Viewer - download version R3.0 SP3. This viewer can display DICOM information (press F9). Since the displayed strings are not stored in the DICOM file itself, I suspect ...
0
votes
0answers
392 views

Intercepting syscall in a shared object (dynamically linked)

Ditto. Any technique that allows to intercept sys calls issued from a shared object file? At runtime, the shared object is dlopen'ed by main(). One candidate is to use static binary rewriting (e.g. ...
0
votes
0answers
583 views

Decompress NAND dump (custom LZ77/LZSS?)

I'm trying to to reverse engineer a very old STB (it was in service between 2005 and 2014). I successfully dumped the NAND of the box but I'm struggling with the compression used. Here is an extract ...
0
votes
0answers
117 views

Detecting and/or converting binary endianness (PPE [CELL] to Intel)

I am by no means a competent programmer in any sense of the word. I've only ever fiddled with .NET building very, very basic applications. If it's possible to be given step-by-step instructions, then ...
0
votes
1answer
2k views

Decode 96 column punch card

I don't know if this is the right place to ask, but I can't seem to find it anywhere on the internet: How do I read a 96 column IBM system/3 punch card? I am doing an exercise but I can't seem to ...

1
2