Questions tagged [binary-analysis]

The process of gathering information about a binary file, either with static or dynamic methods.

Filter by
Sorted by
Tagged with
4
votes
1answer
2k views

Reverse Engineering Windows PowerBuilder Binaries

I recently stumbled across a binary file built using Sybase PowerBuilder 12.5 and I am looking for any assistance in reversing it as it's actually quite different than a typical C++ binary. I'm ...
4
votes
0answers
78 views

JTAG Dumped Flash is scrambled

I dumped the flash memory of an old ARM9 Chip running VxWorks using the SEGGER J-Link and the savebin command from J-Link Commander. Here is an example of a line of HTML stored on memory. <!DOC^...
4
votes
0answers
472 views

How do I perform concolic execution with Angr and collect constraints on input?

I have a program that takes a string (with some structure) as input. My aim is to collect information on what values each character in input is compared to as it gets parsed using concolic execution. ...
4
votes
2answers
1k views

Patching a Mach-O Binary Header to remove a LC_SEGMENT

i have an ARMv7 Mach-O Executable on which I want to patch out a certain segment in the binary header which prevents DYLD injection. more information here under point 3. of preventing dyld injection....
3
votes
3answers
476 views

Way to get basic blocks of a binary using Ghidra

I am using ghidra to do some reverse engineering of an ARM binary. I am wondering whether there is a way to get the basic blocks related to all the listing. Is there a function through the IDE or a ...
3
votes
1answer
280 views

in / out instructions - how should I treat this?

I see a lot of in and out instruction in IDA. I know what those are supposed to do, but I do not know how to treat them and I'm making no advancements in understanding the code. Short example: First ...
3
votes
1answer
9k views

Import table vs Import Address Table

What's the difference between the Import Table and the Import Address Table?
3
votes
2answers
550 views

C++ Unary equals (unary operator=)

In C++ binaries, I find Qt methods like ??4QString@@QEAAAEAV0@AEBV0@@Z which demangle to public: class QString & __ptr64 __cdecl QString::operator=(class QString const & __ptr64) __ptr64 or ...
3
votes
2answers
548 views

Arm ldr diffrent between # and =

In ARM assembly, what is the difference between ldr r4, =0x44454433 and ldr r4, #0x44454433 ?
3
votes
2answers
2k views

Automated Assembly/Disassemble library

I'm writing a handy reverse tool in C++ with manual assembling/disassembling shell, to automate my work! I need an assembler library. Is there any library, embedding in C++?
3
votes
1answer
125 views

Confusing syntax found in malware

I am confused by what the following command is doing: 00401234 mov dword [esp+0x35], sub_408678 For context, I'm reversing a piece of malware and am using Binary Ninja, which to my knowledge ...
3
votes
2answers
257 views

Function prototypes given by Ghidra is not consistent

This is a follow up question to the question I posted over here. According to the answer, I was able to get all the function prototypes from the binary. However, the problem I am having is most of the ...
3
votes
2answers
609 views

Is pointer decryption possible?

I’m pretty new to reverse engineering, so bear with me... I’m trying to get a few struct definitions (or whatever they’re called) from this one binary. After some time fiddling around with it, I’ve ...
3
votes
3answers
5k views

Speedport entry 2i zte home router's firmware

I was searching through my routers admin page some time ago and I've noticed that it doesn't support firmware updates by the user(it's an ISP's speedport entry 2i router(zte variant)). So long story ...
3
votes
1answer
562 views

Computing subtracted stack space for a function manually

Lets assume this function frame : How to calculate and check if subtracted stack space by line 3 is 58h ?: sub esp, 58h And this is the code, the compiler is also Dev C++: #include <stdio.h> ...
3
votes
4answers
442 views

Search remote malware zoo for homologous samples

I've got the following problem: I'd like to find new binaries of a certain malware family -- unpacked -- for subsequent analysis (active C&C comms analysis). Is there a database of binaries ...
3
votes
3answers
813 views

Finding end of file

I have got a file which contains other files. I know where the subfiles start (header) but how do I know where the subfiles end ? Edit: Files are like: sound files (.wav) and images (.bmp, png, jpeg) ...
3
votes
1answer
2k views

Binwalk does not show anything when process binary

I tried use Binwalk to extract content of binary firmware image dumped from flash, but Binwalk does not show anything. I tried commands binwalk -Me file.bin binwalk --dd='.*' file.bin strings ...
3
votes
2answers
53 views

Finding a particular call to an offset within a vtable using pattern matching

Let's say I have a very simple pattern I'm looking for. E.g. the following regex, mov.*(eax|edx|ecx|esi|edi), \[(eax|edx|ecx|esi|edi)\+30h\] Now, I'm also looking for references to this in which the ...
3
votes
1answer
1k views

What are the steps to reverse engineering a Shockwave .DCR file?

I have been fascinated by reverse engineering after making several emulators and finding the pret community. I love the idea behind decompiling old games and recreating source code that recompiles ...
3
votes
2answers
267 views

Problem with converting hex values to decimal

I'm reverse-engineering custom binary file format. I'm using 010 Editor to check this file. I found data structure to represent UTF-8 strings, which has header section of one or two bytes in length ...
3
votes
1answer
2k views

Check if binary was compiled with security checks (/GS)

I have to check massive amount of binaries whether they were compiled with the /GS option. I assume a good indicator would be to check if they have stack cookie or not. Do you know any tool that can ...
3
votes
1answer
956 views

Date and time data extraction from a hex dump

I am trying to retrieve date and time data from a hex dump. I found following entries that has entry id and date time information in it. But, I am not sure about which offset it is. 60 03 00 00 00 F1 ...
3
votes
1answer
1k views

Difference Between Binary Exploitation and Reverse Engineering?

I am a beginner in Reverse Engineering and am trying to improve my skill by participating in any CTF's I can and solving CrackMe's. I am trying to find out why Binary Exploitation and Reverse ...
3
votes
1answer
1k views

Recreating 2D aspects of Cantor.dust

I'm trying to recreate some of the 2D capabilities that were demonstrated in cantor.dust, I was wondering if anyone knows how they translate a large file(executable) into a number of different images /...
3
votes
2answers
2k views

Difference between objdump -r and -R switches

objdump man page says, -r --reloc Print the relocation entries of the file. If used with -d or -D, the relocations are printed interspersed with the disassembly. -R --dynamic-reloc ...
3
votes
1answer
1k views

OllyDbg: Keep comments & labels in rebased DLL

My program loads and unloads a DLL of main interest at runtime. I try to add comments and labels to the DLLs code, but when it is unloaded and loaded again, they are gone, as the DLL is rebased most ...
3
votes
1answer
234 views

custom virtual machine protection

How someone would go to reverse engineer a sample protected with a virtual machine? The problem is that it's not opcode anymore it's bytecode which I don't have any idea about because it's a private ...
3
votes
1answer
1k views

Extract a secret from an Android apk or .so file

Context As an exercise I am researching all methods of hiding a secret in an android mobile app binary... Yes I know that with more or less effort they can always be extracted with static analyses, ...
3
votes
1answer
127 views

Debug point not hit with radare2

I am doing this reverse engenering challenge. I executed theses commands to analyse the main function : radare2.exe ch15.exe aaa s main pdf This is the output of the pdf command : [0x004017b8]> ...
3
votes
2answers
374 views

Track execution of bytes in a Linux executable

Given a binary executable file (in this case, a compiled C file which finds the gcd of 2 numbers), is there a tool which profiles the execution of this file and could generate some sort of call graph ...
3
votes
2answers
297 views

One-pass streaming algorithm for detecting bytecode/opcode?

I am searching for an algorithm and/or snippet of code that provides a one-pass algorithm over a steady datastream that can detect a valid sequence of bytecode or opcode. There are no PE32, ELF, or ...
3
votes
1answer
89 views

How would one find test cases for a self-implemented value set analysis (VSA)?

I read a blog post about value set analysis (VSA). For VSA, see e.g. here. The blog author writes I’ve been trying to get to the point where the example in Balakrishnan’s dissertation works. I ...
3
votes
2answers
2k views

Intel Pin memory operations tracking

I am using Intel Pin in order trace memory activity of an executable on Windows. What I have found, that most of the memory operands (Read or Write) operates with 2 or 4 bytes. So I decided to modify ...
3
votes
1answer
432 views

Trouble analyzing a ransomware

I got this fake-av sample , and I want to reverse it . But the problem is that it exits after few commands . Here are the steps : When loaded in Ollydbg it pauses at: 00401000 > $ 8D9404 7713210&...
3
votes
1answer
101 views

Review a collection of executable binaries to determine similarity

I have a collection of different binaries I want to review for code similarity and classification, but I would rather not have to open each of them in IDA and manually review the code in 15 different ...
3
votes
1answer
133 views

Are there existing automated approaches to reverse engineering the data types in a binary data stream?

Consider a stream of data packets of a known and consistent size, i.e., N bytes per packet. Are there existing tools that automatically detect (or estimate) the various data types present and their ...
3
votes
0answers
962 views

How to extract DVB firmware bin file?

I have a bin file of DVB(DTH) box firmware I want to change one image inside that bin file how I can do this please guide me in right direction. I tried bin walk but the file that it extracted ...
3
votes
0answers
872 views

Reverse-engineering DOS game's data files

I would like to figure out the data format used by an old DOS game I used to play when I was a kid. That link includes a full download for all the files and it runs fine in DOSBox if you want to try ...
3
votes
0answers
1k views

Analysing eCos image

I'm working on unpacking a firmware image. I've already uncompressed the original image, but I'm stuck in the current step. This is the current uncompressed image: https://www.dropbox.com/s/...
3
votes
0answers
393 views

How is the tp-link switch firmware obfuscated?

I was curious and wanted to learn a bit about TP-Link's switch firmware (for example: What OS are they using?). Because I have seen the sg3216 in the real world, I thought, I'd start with that one. ...
2
votes
2answers
9k views

Reverse Engineering a Firmware. Someone can help me?

I am currently trying to reverse-engineer a firmware file to learn the topic but I am a little bit stuck. I tried to use binwalk to get more information about the file but this did not produce ...
2
votes
2answers
318 views

Dynamic analysis of malware samples

I have thousands of Linux malware samples in ELF format. And I am thinking to use dynamic analysis (say, PIN) to obtain an execution trace of each malware sample. However, I am afraid such activity ...
2
votes
1answer
341 views

What is the format of this date time?

I've been writing a small library to allow parsing of the data files used by Sage Accounts 50, but I'm really confused by how it is storing dates. I'm fairly sure that there will be a date created ...
2
votes
2answers
568 views

Unable to extract IP camera firmware

I am trying to extract the firmware for a Panasonic WV-S2131L ip camera. It comes as a .zip file that contains a .img file. I have tried many methods to try to analyze this file and I have found ...
2
votes
1answer
503 views

Visual studio memory allocation reverse engineering

I compile this code with Visual studio 2010 compiler: #include "stdafx.h" #include <iostream> int main() { int *p; p = new int(255); delete []p; } The disassembly of it, is different ...
2
votes
1answer
1k views

idapython find functions that contain a loop

How can I color functions that contain loops in IDApython ? If the end of the basic block can jump to start of basic block it's good enough, even in the rare case this is not a loop. But how do i ...
2
votes
2answers
983 views

Wrong RVA values inside IMAGE_IMPORT_DESCRIPTOR

I load the entire PE into an std::vector<Byte> fileContent using std::fstream. Then I obtain the executable's dos header: IMAGE_DOS_HEADER* imageDosHeader = (IMAGE_DOS_HEADER*)fileContent.data(...
2
votes
3answers
2k views

About the VB P-CODE mode reverse-engineer

I have to reverse-engineer a VB P-CODE mode program. I had the program's P-CODE, but I don't know what it means. For example: Proc: 421840 421100: 04 FLdRfVar local_0098 421103: 04 ...
2
votes
2answers
114 views

gdb shows that EBP contains a value other than some address(which is what it is supposed to contain). How is this possible?

I am fairly new to RE and Binary Exploitation, I have learned basic assembly instructions for Binary Exploitation and I was doing Protostar exercises (stack0) in which I have to simply overflow the ...

1 2
3
4 5
9