Questions tagged [binary-analysis]
The process of gathering information about a binary file, either with static or dynamic methods.
537
questions
0
votes
1
answer
428
views
How to get the input necessary to get to the end
In short, I have a code that gets an input via stdin. Once it has the input string in memory, it verifies its integrity by calling a function for every condition, and exiting the program if those ...
0
votes
0
answers
209
views
How to Find Password/ Bypass Password in a Switch Statement using IDA
I'm new to reverse engineering, wondering how access or bypass the password contained in the switch statement ?
File Link
- 1
0
votes
0
answers
54
views
IDAPython NtCreateFile
Let's say I want to print the filenames on every call to NtCreateFile
(With %any% exe loaded in IDA )
The first problem is to get the ntdll!NtCreateFile address
Tried to do it like this ...
- 1
0
votes
0
answers
94
views
finding a not-so-straightforward game's function
I am working on Mad Max game [ APEX engine ]
I do my best to explain the situation.
so my target executes function like this:
there are commands like " call [eax+XX] " or " call RX &...
- 51
0
votes
0
answers
84
views
Radare2: Running executable from a specific point
I am using radare2 to reverse engineer a standard crackme executable. I have obtained the password, but now I need use the program to read & print a restricted file to which the executable has ...
0
votes
0
answers
182
views
String as constant , even not visible in disassembler
I was reading this article Where I saw that while reversing the WinRAR I saw that the x64dbg is not able to search for a string in all modules "evaluation copy". but why is that happening. ...
- 143
0
votes
0
answers
1k
views
Modify Strings in a ELF (Executable and Linking Format) that are stored in the .rodata
I have 2 ELF files here, each containing strings in the ".rodata" for an translation that I want to modify.
The first ELF "(binary1)" I have already successfully modified from ...
- 83
0
votes
0
answers
529
views
Combine two ELF binaries
Without having access to the original source code, is there a way to combine two ELF binaries with the main() in the first binary pointing to the main() in the second binary ?
In other words, I mean ...
- 156
0
votes
1
answer
102
views
Need some help and advices as regards as reverse engineering IoT devices
Hi everyone, I saw this video on youtube as regards as reversing IPTV cameras and finding security vulnerabilities: Black Hat 2013 - Exploiting Network Surveillance Cameras Like a Hollywood Hacker
I ...
user32648
0
votes
0
answers
120
views
Jump without jmp near
I need to jump a
Hello,
I need to jump some lines that lock program in a loop status.
i use process hacker to find lines with string in binary but when i find this lines i have not jumps near, in ...
- 1
0
votes
1
answer
370
views
In IDA, cannot find xrefs to string in ARM little-endian bootloader/firmware
In this firmware that is ARM Little endian.
There is two strings :
0x00006953 : Foretrex 701
0x00006960 : Foretrex 601
The issue, is there is no direct Xreft to any of thoses strings ?
For the ...
- 1
0
votes
0
answers
407
views
reversing xiaomi update firmware encrypted?
I am playing around with a xiaomi firmware [mijia_4k_0.6.16.02] for a camera
Running binwalk on the file I see this output
DECIMAL HEXADECIMAL DESCRIPTION
----------------------------------...
0
votes
0
answers
206
views
Tools for statistical analysis of binary streams
I'm in the process of decoding the semantics of an unknown binary stream1. I've come to a point where I understand the overall structure: A tag byte, followed by a size field, and a blob of bytes of ...
- 101
0
votes
0
answers
300
views
How can I find loading adress of eCos firmware
From:https://www.tendacn.com/en/download/detail-3482.html
Im trying to find loading address (entry point of my program) for this binary, which is part off this firmware. Im trying to load it inside ...
0
votes
0
answers
289
views
Is there a way to see 'imports' in a .NET binary?
Programs such as Detect It Easy or IDA can show functions and libraries (DLLs) imported by a binary in the case of C/C++ binaries. I have a collection of .NET malware that I'm analyzing and would like ...
- 233
0
votes
1
answer
157
views
What is the best approach for using IDA's remote debugger for analyzing a sample with two VMs?
Sorry if this is a stupid question but couldnt find the answer by googling
Right now I analyze a malware by using remote debugger of IDA, and i run the debugger on a isolated VM that has shared a ...
- 232
0
votes
0
answers
999
views
unsquashfs failed to read SquashFS file
I tried to unpack binary which is SquashFS system, the file is mtd partition copied from NAND device, Root filesystem (read-only). Actually its SquashFS version, modifyed/patched by vendor.
binwalk ...
- 215
0
votes
1
answer
460
views
How to split ARM code/data from binary in Inmarsat Isatphone Pro?
I'm analyzing the 3 binaries for updating firmware to the Inmarsat Isatphone Pro phone. Additionally, I'm following the Groundworks Technologies paper, and attempting to recreate their work as a ...
0
votes
0
answers
268
views
What is this function doing?
I have this function, named __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6__initEPKcm.
And this is the relevant assembly:
mov rdi, [rbp+var_A80]
mov rsi, [rbp+var_A88]
...
- 171
0
votes
0
answers
123
views
Locate compressed section of executable
I am playing with Philips DICOM Viewer - download version R3.0 SP3. This viewer can display DICOM information (press F9). Since the displayed strings are not stored in the DICOM file itself, I suspect ...
- 375
0
votes
0
answers
429
views
Intercepting syscall in a shared object (dynamically linked)
Ditto. Any technique that allows to intercept sys calls issued from a shared object file? At runtime, the shared object is dlopen'ed by main().
One candidate is to use static binary rewriting (e.g. ...
- 101
0
votes
0
answers
693
views
Decompress NAND dump (custom LZ77/LZSS?)
I'm trying to to reverse engineer a very old STB (it was in service between 2005 and 2014). I successfully dumped the NAND of the box but I'm struggling with the compression used.
Here is an extract ...
- 41
0
votes
0
answers
122
views
Detecting and/or converting binary endianness (PPE [CELL] to Intel)
I am by no means a competent programmer in any sense of the word. I've only ever fiddled with .NET building very, very basic applications. If it's possible to be given step-by-step instructions, then ...
- 66
0
votes
1
answer
3k
views
Decode 96 column punch card
I don't know if this is the right place to ask, but I can't seem to find it anywhere on the internet: How do I read a 96 column IBM system/3 punch card?
I am doing an exercise but I can't seem to ...
- 21
-1
votes
2
answers
4k
views
XOR encryption - How to find the key?
I'm trying to solve a crackme which basically uses a XOR encryption scheme in which the password is used as the key to an encrypted buffer which is subsequently executed. The following is the ...
- 11
-1
votes
1
answer
2k
views
How to extract D-Link DCS-4603 camera firmware
I tried extract the firmware image from the binary file available at the D-Link DCS-4603 Vigilance Full HD PoE Dome Network Camera technical support page it by using binwalk but failed. Is there ...
- 323
-1
votes
1
answer
704
views
Shells CTF segfault - wrong address
PicoCTF 2017 Shells
I have a binary and source:
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/mman.h>
#define AMOUNT_OF_STUFF 10
//TODO: Ask IT ...
-1
votes
1
answer
235
views
Instrument memory accesses of python scripts
My research requires processing memory traces of applications. For C/C++ programs, this is easy using Intel's PIN library. However, as suggested here https://stackoverflow.com/questions/51835532/use-...
-1
votes
2
answers
2k
views
Getting the function's original file name within Ghidra
I am trying to extract the original file name of some functions through Ghidra. In particular I have enabled the debug symbols so that it does contains the function names in the disassembly listing ...
- 281
-1
votes
1
answer
156
views
Understanding what is represented by function pointers to a block of hex
I'm working on a disassembly project for my class where I'm trying to bypass a license check, but when I throw the executable into Binary Ninja this is what I see:
And when I look at those pointers, ...
-1
votes
1
answer
842
views
Converting object file to LLVM bitcode
Frameworks like mcsema is used to convert an executable file into LLVM bitcode which can be further used to perform program analysis.
Is there any way to convert an object file in the similar way?
- 23
-1
votes
1
answer
596
views
Disassembling code with Hopper
I'm trying to figure out what this code is doing.
The first thing that I don't understand is the condition that tests if arg0's value is 0x2. I read that 0x2 in ASCII is STX (Start of text).
Here's ...
-2
votes
2
answers
15k
views
Extract data from firmware (.bin) file which is compressed or encrypted
I have a firmware image of LCD TV that I want to research. Basically I want to customize RGB color settings (from source code), Logo of TV ... Is it possible? I binwalk to scan the file.
binwalk ...
- 11
-2
votes
1
answer
207
views
Is there always 1:1 correlation between hexadecimal and binary?
I was wondering this because I have found that some instructions, on the machine code level, are too large if taken a step down from hex to 0s and 1s.
On Motorola 68000 I found that some instructions ...
- 29
-3
votes
1
answer
1k
views
Identification of AES portion code in binary
I want to locate AES code portion in binary after reverse engineering. I have tried to locate manually and using plugin findcrypt2 but I was not successful. Kindly show me a direction so that I can ...
-3
votes
1
answer
2k
views
what does VA and OEP means? and How does IAT be fixed manually? [closed]
in the context of reversing a packed binary, what does VA and OEP means? and How can IAT be fixed manually?
-5
votes
2
answers
1k
views
Bin file is not only storing 0s and 1s, ASCII or otherwise
Upon checking out a binary file, and according to convincing evidence, .bin file extensions are supposed to denote a file type which stores its data as 0s and 1s, or 31/32 in ASCII hex(ASCII character ...
