Skip to main content

Questions tagged [binary-analysis]

The process of gathering information about a binary file, either with static or dynamic methods.

Filter by
Sorted by
Tagged with
7 votes
1 answer
4k views

Reverse-engineering a tough-to-crack video game save-file checksum

Been trying to figure this one out for a while now, and would be eternally grateful for anyone with more experience in checksum algorithms lending a hand. I've been trying to alter save files for an ...
Erik Elgerot's user avatar
7 votes
1 answer
667 views

How to find if a given library function is used in a binary?

Assuming that library X is statically linked, is there a way to know with an acceptable grade of confidence if a function from it was used in the binary? I am currently using this approach: Convert ...
Not Now's user avatar
  • 71
7 votes
1 answer
348 views

Byte frequencies in different architectures' binaries?

what I'm looking for I have a binary that, for various reasons, I'm pretty sure is executable machine code (although possibly for a VM language, although I doubt it's Java). I'm looking for a table ...
Parthian Shot's user avatar
6 votes
2 answers
34k views

Extract files from a bin firmware

I have a firmware image that is used for flashing a BMW NBT navigation system that I want to research. I did a binwalk on the file (dump below). I want to extract the individual files, especially the ...
Remko's user avatar
  • 3,273
6 votes
4 answers
3k views

Way to get basic blocks of a binary using Ghidra

I am using ghidra to do some reverse engineering of an ARM binary. I am wondering whether there is a way to get the basic blocks related to all the listing. Is there a function through the IDE or a ...
hEShaN's user avatar
  • 281
6 votes
1 answer
1k views

I need quick correction on this x86 opcode conundrum

I am trying to figure out how to encode the instruction MOV DS, AX, but I am confused from the opcode table as follows: Is MOV DS all one byte, or is MOV one byte, DS the second, and the AX the third?...
Jonas' River's user avatar
6 votes
3 answers
5k views

Running a binary identified as an ARM excutable by binwalk --disasm

I have a Philips 10FF2 picture frame I'm trying to reverse engineer. In the firmware download from the Philips website (http://download.p4c.philips.com/files/1/10ff2cme_00/10ff2cme_00_fus_aen.zip) I ...
Walter Heck's user avatar
6 votes
5 answers
3k views

What is the "standard" approach to find loop in binary code?

I am working on some x86 (32/64 bits) ELF binary code. These binaries are compiled from C and C++ program code and I am trying to detect loops inside the binaries. I am newbie to this area, and I am ...
lllllllllllll's user avatar
6 votes
2 answers
715 views

Reverse engineering Perl-compatible regular-expressions

I'm dealing with a piece of malware that does extensive use of PCRE (Perl-compatible regular expressions). Normally I would be able to read them, but it seems they're in some kind of binary format (...
Thomas Chopitea's user avatar
6 votes
1 answer
7k views

Get section's names and headers for a file using C++

I'm implementing a software for performing some PE classification. Among the features values I'm gathering from each PE are, the amount of sections, the name of sections, image section headers. I have ...
Raydel Miranda's user avatar
6 votes
2 answers
397 views

Find level data in binaries?

I am trying to recreate an old game just for the sake of nostalgia and learning something new alongside (I can program in various languages and know a bit of assembly language, but I'm new to reverse ...
Kenji's user avatar
  • 163
6 votes
3 answers
9k views

How to SUCCESSFULLY add a code section to an executable file in Linux?

I am in Linux, and I have seen this question a few times but never, nobody answered how to really make this work. I need to add a section to an already compiled binary. Lets say for a moment is an ...
0xfede7c8's user avatar
  • 243
6 votes
1 answer
1k views

Reversing simple message + checksum pairs (32 bytes)

I am trying to determine the algorithm behind a 32-byte protected section of memory on a big-endian system. It will render invalid if even a single bit is changed, but I can generate any number of ...
bryc's user avatar
  • 163
6 votes
1 answer
3k views

IDA Pro for MIPS image

I have this file: [ytti@lintukoto ~/tmp/ida]% file cat3k_caa-universalk9.SPA.03.03.00.SE.150-1.EZ.bin cat3k_caa-universalk9.SPA.03.03.00.SE.150-1.EZ.bin: data It's image for Cisco Catalyst 3650 ...
ytti's user avatar
  • 161
6 votes
1 answer
3k views

Reversing a 3D file format from 2001

This is a korean MMORPG released back in 2001. The game and the company no longer exists. I've been analyzing the file formats as a personal project for awhile now. I have already decoded the ...
majidarif's user avatar
  • 235
6 votes
1 answer
264 views

What is the scalability of state of the art static binary analysis techniques?

What is the largest program that has been analyzed by a semantics-based static binary analysis? By semantics-based, I mean an analysis that examines the meaning of the program, and does not simply ...
Ed McMan's user avatar
  • 944
6 votes
1 answer
545 views

Difference between Win7 and Win8 PE loader?

Is it known what the differences between the Window 7 and Windows 8 PE loader are? I'm trying to hand-craft a simple executable PE image file. It runs well in Windows 7, but is rejected by Windows 8....
Lars Brinkhoff's user avatar
5 votes
3 answers
4k views

Is learning assembly enough to become a malware analyst? [closed]

I am a C/C++ developer and I have started learning assembly language programming with the goal to become a malware analyst. I know it is not enough to just know how to read assembly to become a ...
Pranit Kothari's user avatar
5 votes
2 answers
2k views

Difference between Main and Entry

Sometimes, I see while disassembling a binary that there is the main function. but sometimes, instead of main, there is entry function. I want to know what is the difference between entry and main.
lucky thandel's user avatar
5 votes
4 answers
2k views

Why are PUSHF and POPF so slow?

the experiment is on 32-bit x86 Linux. I am doing some static binary instrumentation work, and basically I am trying to insert some instructions below to the beginning of every basic block. BB23 : ...
lllllllllllll's user avatar
5 votes
2 answers
852 views

Understanding the loop disassembly

Here is the code of loop that I'm trying to understand the disassembly of it: #include<stdio.h> #include <iostream> using namespace std; int main() { int i, arr[50], num; printf("...
Vlad's user avatar
  • 139
5 votes
1 answer
722 views

Why is true emulation not possible?

Antiviruses and similar analysis engines often face the problem of identifying whether the file is harmful. They often do so with the use of (partial)emulation and as a result often fall prey to the ...
viv's user avatar
  • 784
5 votes
4 answers
2k views

Is BinNavi available? If not, can I get the source from anywhere?

BinNavi is originally a Zynamics product. But, since the company has been bought by Google, it seems to be difficult to get the library. I tried to look in the BinNavi manual in the installation ...
perror's user avatar
  • 19.1k
5 votes
2 answers
355 views

Flare-ON#3: Problem understanding some parts in the program

I was trying the flare on challenge. When trying the challenge#3 I got into some trouble and could not solve it. After looking into solutions wrote by other I now do know how the program works, but i ...
Nishan Maharjan's user avatar
5 votes
2 answers
4k views

How to identify functions in a stripped binary on x86 32bit?

I am trying to generate a coarse-grained Call Graph based on some assembly code disassembled from binary on x86 32 bit platform. It is very hard to generate a precise Call Graph based on asm code, ...
lllllllllllll's user avatar
5 votes
1 answer
1k views

Reverse engineer 4-bit CRC in LG IR packet

I am reverse engineering IR protocol of LG air conditioner. AC generally send the whole current state of remote on each key press. Data sent is 28 bits long, last 4 bits seem to be the checksum. I ...
Marki555's user avatar
  • 253
5 votes
1 answer
3k views

Find file signatures inside an unknown file

I have a .bin file I would like to analyse. Especially find images embedded in this firmware update. binwalk couldn't find anything. What other tools do you know to search for possible embedded ...
samuirai's user avatar
  • 3,079
5 votes
1 answer
6k views

Find the C++ STL functions in a binary

I have a binary file (actually, an operating system for an ARM embedded device which also contains some high-level apps (hard coded in the user interface)). I know some parts of the operating system ...
m4524t's user avatar
  • 53
5 votes
1 answer
2k views

OLLYdbg is stopping on 7000000 addresses on the ntdll and not the entry point of the application

i am solving the leena's 4th binary challenge.but the ollydbg is unable to stop at Entry point which some around 400000 or above.Application stops working and start with some around 700000 check the ...
Bikash Dash's user avatar
5 votes
1 answer
4k views

How to reverse command line arguments?

I am working on a console windows executable. So far what I figured out is that the executable checks number of command line arguments. Afterwards, it branches out depending on the number of arguments ...
PSS's user avatar
  • 3,088
5 votes
3 answers
2k views

Changing a windows name by patching create window function call

I use x64dbg and IDA Pro the process is 32bit. I'm not sure if I'm doing this right or not because I'm getting a crash which I'm not sure if it's caused by me doing something wrong or the startup ...
notvita's user avatar
  • 51
5 votes
2 answers
4k views

Difference between objdump -r and -R switches

objdump man page says, -r --reloc Print the relocation entries of the file. If used with -d or -D, the relocations are printed interspersed with the disassembly. -R --dynamic-reloc ...
sherlock's user avatar
  • 1,381
5 votes
1 answer
11k views

Decrypting firmware: Is there a true "format" to it, and how does it differ from decryping other files?

I have firmware for a system and I'm trying to decrypt some of it just for the sake of seeing what it all does; nothing illegal or anything like that, such as reproducing copies of it decrypted and ...
stack full of heaps's user avatar
5 votes
1 answer
303 views

Reverse engineering in pairs - is it possible?

I'm interested if anyone can share from his experience how to analyze complex binaries in pairs - 2 RE engineers. Are there any suitable methodologies, tools to help in such work? UPDATE This is ...
PhoeniX's user avatar
  • 3,062
5 votes
2 answers
1k views

What kind of function creates this code pattern?

Apologies if this is a duplicate. Don't know what words to search for as that's what the question is about. I'm relatively new to reverse engineering binaries and while using Ghidra I've noticed that ...
That Guy's user avatar
5 votes
2 answers
2k views

Patching a Mach-O Binary Header to remove a LC_SEGMENT

i have an ARMv7 Mach-O Executable on which I want to patch out a certain segment in the binary header which prevents DYLD injection. more information here under point 3. of preventing dyld injection....
Malte's user avatar
  • 183
5 votes
1 answer
5k views

Reverse engineering a proprietary GPU device driver?

I have the binary file, and it's over 200 MB in size, which makes me think that such a task by myself would be beyond incredibly difficult to get anything done. I am trying to see how the driver ...
Truffles In Ma Bred's user avatar
5 votes
1 answer
195 views

Review a collection of executable binaries to determine similarity

I have a collection of different binaries I want to review for code similarity and classification, but I would rather not have to open each of them in IDA and manually review the code in 15 different ...
solumnant's user avatar
  • 173
5 votes
1 answer
411 views

Are there existing automated approaches to reverse engineering the data types in a binary data stream?

Consider a stream of data packets of a known and consistent size, i.e., N bytes per packet. Are there existing tools that automatically detect (or estimate) the various data types present and their ...
J. Tylka's user avatar
  • 151
5 votes
0 answers
342 views

Radare2 8051 code bank switching

Some of 8051 chips use bank switching to extend accessible code memory. Good example is Silabs C8051F12x. Another example is here. Code area in range 0x0000..0x7ffff is common always accessible code ...
kimstik's user avatar
  • 159
5 votes
0 answers
142 views

JTAG Dumped Flash is scrambled

I dumped the flash memory of an old ARM9 Chip running VxWorks using the SEGGER J-Link and the savebin command from J-Link Commander. Here is an example of a line of HTML stored on memory. <!DOC^...
user3547018's user avatar
5 votes
0 answers
1k views

How do I perform concolic execution with Angr and collect constraints on input?

I have a program that takes a string (with some structure) as input. My aim is to collect information on what values each character in input is compared to as it gets parsed using concolic execution. ...
Rahul Gopinath's user avatar
5 votes
1 answer
692 views

How to read these UV coordinates?

I'm trying to reverse engineer 3D models (cars) from a racing game from 1997 (Test Drive 4). I'm able to extract the 3D mesh and textures, but cannot figure out how UV mapping works yet. There is ...
Midas's user avatar
  • 51
4 votes
1 answer
4k views

Correct way to understand local_ in ghidra disassembly

Attached is the part of a disassembled main from a x86 binary file, generated by ghidra. ************************************************************** ...
Mah35h's user avatar
  • 133
4 votes
1 answer
1k views

Heap Chunk Structure Does Not Contain Previous Section Info

I'm reading Shellcoder's Handbook to learn more about exploitation and overflows. I reached the chapter on Heap Overflows. The book mentions that a heap is split into chunks where each chunk contains ...
Solidak's user avatar
  • 143
4 votes
2 answers
3k views

Function prototypes given by Ghidra is not consistent

This is a follow up question to the question I posted over here. According to the answer, I was able to get all the function prototypes from the binary. However, the problem I am having is most of the ...
hEShaN's user avatar
  • 281
4 votes
4 answers
2k views

Tools to show the registers and memory locations in use during execution?

I am looking for something that is like gdb but maybe with a GUI that can show all registers current values ans the current values of memory and things on the stack? Freeware is preferred. I have a ...
user avatar
4 votes
1 answer
775 views

On SPARC, what happens when a branch is placed in the branch-delay slot of another branch?

Our team recently had to look at SPARC assembly specifications, the problem is that I do not have a SPARC processor to try things on it (I should set up a simulator or get one of these old Sparc ...
perror's user avatar
  • 19.1k
4 votes
1 answer
624 views

Reverse Engineering bios of ATM Machine

I bought an Hyosung NH1500 off Offer-up and it boots up and initializes some peripherals and then spits out and error of "COM download is failed". I've searched Google and 0 results came up, I've been ...
flipbeatz's user avatar
4 votes
3 answers
2k views

Automatically decode PUSH+RET call into JMP

While reversing a piece of malware I've faced with anti-disasm trick, that actually is well described here. So my question is: would the assembly patching of whole the PUSH+RET stubs to JMP(i.e. C3-> ...
see ya's user avatar
  • 823

1
2
3 4 5
11