Questions tagged [binary-analysis]
The process of gathering information about a binary file, either with static or dynamic methods.
537
questions
7
votes
1
answer
4k
views
Reverse-engineering a tough-to-crack video game save-file checksum
Been trying to figure this one out for a while now, and would be eternally grateful for anyone with more experience in checksum algorithms lending a hand.
I've been trying to alter save files for an ...
- 71
7
votes
1
answer
619
views
How to find if a given library function is used in a binary?
Assuming that library X is statically linked, is there a way to know with an acceptable grade of confidence if a function from it was used in the binary?
I am currently using this approach:
Convert ...
- 71
7
votes
1
answer
345
views
Byte frequencies in different architectures' binaries?
what I'm looking for
I have a binary that, for various reasons, I'm pretty sure is executable machine code (although possibly for a VM language, although I doubt it's Java). I'm looking for a table ...
- 281
6
votes
2
answers
34k
views
Extract files from a bin firmware
I have a firmware image that is used for flashing a BMW NBT navigation system that I want to research. I did a binwalk on the file (dump below).
I want to extract the individual files, especially the ...
- 3,208
6
votes
4
answers
3k
views
Way to get basic blocks of a binary using Ghidra
I am using ghidra to do some reverse engineering of an ARM binary. I am wondering whether there is a way to get the basic blocks related to all the listing. Is there a function through the IDE or a ...
- 281
6
votes
1
answer
1k
views
I need quick correction on this x86 opcode conundrum
I am trying to figure out how to encode the instruction MOV DS, AX, but I am confused from the opcode table as follows:
Is MOV DS all one byte, or is MOV one byte, DS the second, and the AX the third?...
- 61
6
votes
3
answers
5k
views
Running a binary identified as an ARM excutable by binwalk --disasm
I have a Philips 10FF2 picture frame I'm trying to reverse engineer. In the firmware download from the Philips website (http://download.p4c.philips.com/files/1/10ff2cme_00/10ff2cme_00_fus_aen.zip) I ...
- 163
6
votes
5
answers
3k
views
What is the "standard" approach to find loop in binary code?
I am working on some x86 (32/64 bits) ELF binary code. These binaries are compiled from C and C++ program code and I am trying to detect loops inside the binaries.
I am newbie to this area, and I am ...
- 2,475
6
votes
2
answers
704
views
Reverse engineering Perl-compatible regular-expressions
I'm dealing with a piece of malware that does extensive use of PCRE (Perl-compatible regular expressions). Normally I would be able to read them, but it seems they're in some kind of binary format (...
- 121
6
votes
1
answer
7k
views
Get section's names and headers for a file using C++
I'm implementing a software for performing some PE classification. Among the features values I'm gathering from each PE are, the amount of sections, the name of sections, image section headers.
I have ...
- 223
6
votes
2
answers
391
views
Find level data in binaries?
I am trying to recreate an old game just for the sake of nostalgia and learning something new alongside (I can program in various languages and know a bit of assembly language, but I'm new to reverse ...
- 163
6
votes
3
answers
9k
views
How to SUCCESSFULLY add a code section to an executable file in Linux?
I am in Linux, and I have seen this question a few times but never, nobody answered how to really make this work.
I need to add a section to an already compiled binary. Lets say for a moment is an ...
- 243
6
votes
1
answer
1k
views
Reversing simple message + checksum pairs (32 bytes)
I am trying to determine the algorithm behind a 32-byte protected section of memory on a big-endian system. It will render invalid if even a single bit is changed, but I can generate any number of ...
- 163
6
votes
1
answer
3k
views
IDA Pro for MIPS image
I have this file:
[ytti@lintukoto ~/tmp/ida]% file cat3k_caa-universalk9.SPA.03.03.00.SE.150-1.EZ.bin
cat3k_caa-universalk9.SPA.03.03.00.SE.150-1.EZ.bin: data
It's image for Cisco Catalyst 3650 ...
- 161
6
votes
1
answer
264
views
What is the scalability of state of the art static binary analysis techniques?
What is the largest program that has been analyzed by a semantics-based static binary analysis?
By semantics-based, I mean an analysis that examines the meaning of the program, and does not simply ...
- 944
6
votes
1
answer
542
views
Difference between Win7 and Win8 PE loader?
Is it known what the differences between the Window 7 and Windows 8 PE loader are?
I'm trying to hand-craft a simple executable PE image file. It runs well in Windows 7, but is rejected by Windows 8....
- 163
5
votes
3
answers
4k
views
Is learning assembly enough to become a malware analyst? [closed]
I am a C/C++ developer and I have started learning assembly language programming with the goal to become a malware analyst.
I know it is not enough to just know how to read assembly to become a ...
- 927
5
votes
2
answers
1k
views
Difference between Main and Entry
Sometimes, I see while disassembling a binary that there is the main function. but sometimes, instead of main, there is entry function.
I want to know what is the difference between entry and main.
- 143
5
votes
4
answers
2k
views
Why are PUSHF and POPF so slow?
the experiment is on 32-bit x86 Linux.
I am doing some static binary instrumentation work, and basically I am trying to insert some instructions below to the beginning of every basic block.
BB23 : ...
- 2,475
5
votes
2
answers
836
views
Understanding the loop disassembly
Here is the code of loop that I'm trying to understand the disassembly of it:
#include<stdio.h>
#include <iostream>
using namespace std;
int main() {
int i, arr[50], num;
printf("...
- 139
5
votes
1
answer
719
views
Why is true emulation not possible?
Antiviruses and similar analysis engines often face the problem of identifying whether the file is harmful. They often do so with the use of (partial)emulation and as a result often fall prey to the ...
- 784
5
votes
4
answers
2k
views
Is BinNavi available? If not, can I get the source from anywhere?
BinNavi is originally a Zynamics product. But, since the company has been bought by Google, it seems to be difficult to get the library.
I tried to look in the BinNavi manual in the installation ...
- 18.9k
5
votes
2
answers
352
views
Flare-ON#3: Problem understanding some parts in the program
I was trying the flare on challenge. When trying the challenge#3 I got into some trouble and could not solve it. After looking into solutions wrote by other I now do know how the program works, but i ...
5
votes
2
answers
4k
views
How to identify functions in a stripped binary on x86 32bit?
I am trying to generate a coarse-grained Call Graph based on some assembly code disassembled from binary on x86 32 bit platform.
It is very hard to generate a precise Call Graph based on asm code, ...
- 2,475
5
votes
1
answer
1k
views
Reverse engineer 4-bit CRC in LG IR packet
I am reverse engineering IR protocol of LG air conditioner. AC generally send the whole current state of remote on each key press. Data sent is 28 bits long, last 4 bits seem to be the checksum. I ...
- 253
5
votes
1
answer
3k
views
Find file signatures inside an unknown file
I have a .bin file I would like to analyse. Especially find images embedded in this firmware update.
binwalk couldn't find anything.
What other tools do you know to search for possible embedded ...
- 3,059
5
votes
1
answer
5k
views
Find the C++ STL functions in a binary
I have a binary file (actually, an operating system for an ARM embedded device which also contains some high-level apps (hard coded in the user interface)).
I know some parts of the operating system ...
- 53
5
votes
1
answer
2k
views
OLLYdbg is stopping on 7000000 addresses on the ntdll and not the entry point of the application
i am solving the leena's 4th binary challenge.but the ollydbg is unable to stop at Entry point which some around 400000 or above.Application stops working and start with some around 700000
check the ...
- 119
5
votes
1
answer
3k
views
How to reverse command line arguments?
I am working on a console windows executable. So far what I figured out is that the executable checks number of command line arguments. Afterwards, it branches out depending on the number of arguments ...
- 3,088
5
votes
3
answers
2k
views
Changing a windows name by patching create window function call
I use x64dbg and IDA Pro the process is 32bit. I'm not sure if I'm doing this right or not because I'm getting a crash which I'm not sure if it's caused by me doing something wrong or the startup ...
- 51
5
votes
2
answers
4k
views
Difference between objdump -r and -R switches
objdump man page says,
-r
--reloc
Print the relocation entries of the file. If used with -d or -D,
the relocations are printed interspersed with the disassembly.
-R
--dynamic-reloc
...
- 1,371
5
votes
1
answer
11k
views
Decrypting firmware: Is there a true "format" to it, and how does it differ from decryping other files?
I have firmware for a system and I'm trying to decrypt some of it just for the sake of seeing what it all does; nothing illegal or anything like that, such as reproducing copies of it decrypted and ...
5
votes
1
answer
303
views
Reverse engineering in pairs - is it possible?
I'm interested if anyone can share from his experience how to analyze complex binaries in pairs - 2 RE engineers.
Are there any suitable methodologies, tools to help in such work?
UPDATE
This is ...
- 3,002
5
votes
2
answers
1k
views
What kind of function creates this code pattern?
Apologies if this is a duplicate. Don't know what words to search for as that's what the question is about.
I'm relatively new to reverse engineering binaries and while using Ghidra I've noticed that ...
- 65
5
votes
1
answer
3k
views
Reversing a 3D file format from 2001
This is a korean MMORPG released back in 2001. The game and the company no longer exists. I've been analyzing the file formats as a personal project for awhile now.
I have already decoded the ...
- 225
5
votes
2
answers
2k
views
Patching a Mach-O Binary Header to remove a LC_SEGMENT
i have an ARMv7 Mach-O Executable on which I want to patch out a certain segment in the binary header which prevents DYLD injection.
more information here under point 3. of preventing dyld injection....
- 183
5
votes
1
answer
5k
views
Reverse engineering a proprietary GPU device driver?
I have the binary file, and it's over 200 MB in size, which makes me think that such a task by myself would be beyond incredibly difficult to get anything done. I am trying to see how the driver ...
5
votes
1
answer
195
views
Review a collection of executable binaries to determine similarity
I have a collection of different binaries I want to review for code similarity and classification, but I would rather not have to open each of them in IDA and manually review the code in 15 different ...
- 173
5
votes
1
answer
359
views
Are there existing automated approaches to reverse engineering the data types in a binary data stream?
Consider a stream of data packets of a known and consistent size, i.e., N bytes per packet.
Are there existing tools that automatically detect (or estimate) the various data types present and their ...
- 151
5
votes
0
answers
314
views
Radare2 8051 code bank switching
Some of 8051 chips use bank switching to extend accessible code memory.
Good example is Silabs C8051F12x. Another example is here.
Code area in range 0x0000..0x7ffff is common always accessible code ...
- 159
5
votes
0
answers
129
views
JTAG Dumped Flash is scrambled
I dumped the flash memory of an old ARM9 Chip running VxWorks using the SEGGER J-Link and the savebin command from J-Link Commander.
Here is an example of a line of HTML stored on memory.
<!DOC^...
- 51
5
votes
0
answers
952
views
How do I perform concolic execution with Angr and collect constraints on input?
I have a program that takes a string (with some structure) as input. My aim is to collect information on what values each character in input is compared to as it gets parsed using concolic execution. ...
- 151
5
votes
1
answer
664
views
How to read these UV coordinates?
I'm trying to reverse engineer 3D models (cars) from a racing game from 1997 (Test Drive 4). I'm able to extract the 3D mesh and textures, but cannot figure out how UV mapping works yet.
There is ...
- 51
4
votes
1
answer
4k
views
Correct way to understand local_ in ghidra disassembly
Attached is the part of a disassembled main from a x86 binary file, generated by ghidra.
**************************************************************
...
- 133
4
votes
1
answer
1k
views
Heap Chunk Structure Does Not Contain Previous Section Info
I'm reading Shellcoder's Handbook to learn more about exploitation and overflows. I reached the chapter on Heap Overflows. The book mentions that a heap is split into chunks where each chunk contains ...
- 143
4
votes
2
answers
3k
views
Function prototypes given by Ghidra is not consistent
This is a follow up question to the question I posted over here. According to the answer, I was able to get all the function prototypes from the binary. However, the problem I am having is most of the ...
- 281
4
votes
4
answers
2k
views
Tools to show the registers and memory locations in use during execution?
I am looking for something that is like gdb but maybe with a GUI that can show all registers current values ans the current values of memory and things on the stack? Freeware is preferred. I have a ...
user4466
4
votes
1
answer
759
views
On SPARC, what happens when a branch is placed in the branch-delay slot of another branch?
Our team recently had to look at SPARC assembly specifications, the problem is that I do not have a SPARC processor to try things on it (I should set up a simulator or get one of these old Sparc ...
- 18.9k
4
votes
1
answer
593
views
Reverse Engineering bios of ATM Machine
I bought an Hyosung NH1500 off Offer-up and it boots up and initializes some peripherals and then spits out and error of "COM download is failed". I've searched Google and 0 results came up, I've been ...
- 43
4
votes
3
answers
2k
views
Automatically decode PUSH+RET call into JMP
While reversing a piece of malware I've faced with anti-disasm trick, that actually is well described here.
So my question is: would the assembly patching of whole the PUSH+RET stubs to JMP(i.e. C3-> ...
- 823