Questions tagged [binary-analysis]
The process of gathering information about a binary file, either with static or dynamic methods.
537
questions
4
votes
1
answer
3k
views
What are the steps to reverse engineering a Shockwave .DCR file?
I have been fascinated by reverse engineering after making several emulators and finding the pret community. I love the idea behind decompiling old games and recreating source code that recompiles ...
- 143
4
votes
1
answer
4k
views
Are there any static binary rewriting tools？
My goal is to modify some instructions and make some instrumentation in ELF executables or libraries(For example, modifying all memory writes instructions). Since there're so many instructions, I want ...
- 115
4
votes
1
answer
6k
views
How can a format string vulnerability be used to write a specific string into memory?
I think I understand how a format string vulnerability works, but what I have seen so far it can only be used to increase the value of an integer.
Can format string vulnerability also be used to ...
4
votes
2
answers
313
views
What are the popular machine learning unsupervised approaches to learning binary data representations?
This is somewhat open-ended question, so bear with me please.
Be it a binary payload that you pull from network packet, firmware blob you pull of some EPROM or data intercepted straight from physical ...
- 143
4
votes
1
answer
5k
views
How to get the disassembly line without offset translations in IDAPython?
When I use GetDisasm()to get disassembly line, I find out that it will show some memory references as a variable name.
For example, when raw assembly is:
mov %r15, 0x20b062(%rip)`
GetDisasm()'s ...
- 115
4
votes
1
answer
3k
views
Difference Between Binary Exploitation and Reverse Engineering?
I am a beginner in Reverse Engineering and am trying to improve my skill by participating in any CTF's I can and solving CrackMe's. I am trying to find out why Binary Exploitation and Reverse ...
- 143
4
votes
1
answer
1k
views
Recreating 2D aspects of Cantor.dust
I'm trying to recreate some of the 2D capabilities that were demonstrated in cantor.dust, I was wondering if anyone knows how they translate a large file(executable) into a number of different images /...
- 41
4
votes
1
answer
895
views
Radare2 ptrace can not attach
First my setup:
Linux Mint 64bit 4.15.0-20-generic
radare2 the newest version from github
/etc/sysctl.d/10-ptrace.conf = 0
Executable:
ELF 64-bit LSB executable, x86-64
read write and ...
- 191
4
votes
1
answer
201
views
Is this Bignum multiplication of 2048 RSA number a Montgomery multiplication?
The below code snippets are some kind of bignum multiplications involving 2048bit numbers, possibly in the context of RSA decryption.
Does any one recognize this pattern?
Is it maybe some kind of ...
- 289
4
votes
1
answer
3k
views
Modifying a binary save-data file for a video game with a CRC/Checksum check
I recently overwrote the save game file of a video game that my girlfriend and I had been playing through. After trying to recover the file a few different ways (game didn't erase but overwrote the ...
- 43
4
votes
1
answer
173
views
Mickey Mouse toy bin file analysis
I am trying to reverse engineer a Mickey Mouse toy just for fun but I am stuck.
The toy has several buttons that play various phrases and songs.
My aim was to see if I can read those songs from the ...
4
votes
1
answer
3k
views
Extract a secret from an Android apk or .so file
Context
As an exercise I am researching all methods of hiding a secret in an android mobile app binary... Yes I know that with more or less effort they can always be extracted with static analyses, ...
- 141
4
votes
1
answer
684
views
How can the problem posed for disassembly by the mixture of executable code and literal pools in ARM firmware be overcome?
Context and Background Information
Part 1: ARM firmware compared to firmware for other architectures
I looked at the ARM firmware in these two questions:
Running a binary identified as an ARM ...
- 7,078
4
votes
2
answers
1k
views
What is the difference between program slicing and taint analysis?
I'm studying program slicing and taint analysis. I know notion of program slicing and taint analysis.
I think Program slicing and taint analysis are similar notion.
I don' know difference between ...
- 51
4
votes
1
answer
473
views
Challenging variable-length integer encoding
I have a piece of binary data I'm trying to investigate. My guess is that it should be part of simple filesystem-like index. There are 2 parts in the file. First part has a very simple format:
number ...
- 141
4
votes
2
answers
1k
views
Locating Memory Allocation Functions from Static Analysis
I'm currently working on reversing a firmware binary for an embedded device. This device is using an uncommon architecture: it is a modified Harvard architecture, running on a TMS320C55x chipset with ...
- 397
4
votes
1
answer
133
views
💻 This code does not crash on ARM (qemu). Why?
I found a couple of interesting integer underflows leading to memcpy() wild copies in a TLV parser process of some random IoT firmware. It is 32-bit ARMv7.
I'm able to emulate the userspace process ...
- 61
4
votes
2
answers
1k
views
Reverse engineer 4-bit checksum (?) in Sanyo air conditioning IR packet
I am reverse engineering IR protocol of Sanyo air conditioner. AC sends the whole current state of remote on each key press. Data sent is 67 bits long, last 4 bits seem to be the some kind of error ...
- 49
4
votes
1
answer
2k
views
How to extract DVB firmware bin file?
I have a bin file of DVB (DTH) box firmware. I want to change one image inside that bin file, how I can do this? Please guide me in right direction.
I tried bin walk, but the file that it extracted ...
- 141
4
votes
1
answer
326
views
How to find the index of static ilbrary functions in the PLT of the binary?
So right now I'm trying to resolve function calls and their names in my reversing tool
the problem I'm having is that library functions such as printf and fwrite and such do not have a corresponding ...
- 99
4
votes
2
answers
958
views
Identification of D-Link firmware checksum and adding it to OpenWrt firmware
I have this D-Link firmware and would like to identify checksum type used on it and add it to OpenWrt bin file so I could upgrade firmware to OpenWrt instead default crappy D-Link. I did tried to ...
- 515
4
votes
1
answer
4k
views
Reverse Engineering Windows PowerBuilder Binaries
I recently stumbled across a binary file built using Sybase PowerBuilder 12.5 and I am looking for any assistance in reversing it as it's actually quite different than a typical C++ binary. I'm ...
- 397
4
votes
1
answer
6k
views
How to decrypt the config.bin from ZTE ZXV10 H201L
I have this file from my router its backup of user config,I suppose its compresed with zlib and encrypted with AES. Utility which is resposible to compress it and encrypt it is called cspd. In side ...
- 515
4
votes
0
answers
161
views
How to assemble back a disassembled Linux kernel?
I have a Linux kernel file and I need to tweak the contents of its corresponding initramfs. I did it in the past for standard distros where kernel and initramfs were separate. However, this specific ...
- 141
3
votes
1
answer
10k
views
How to print the value of register with Radare 2
I am trying to solve this ELF - Ptrace challenge. I use Radare 2. This is the commands I execute to print the assembly code.
radare2 ch3.bin
[0x080482f0]> aaa
[[anal.jmptbl] Missing cjmp bb in ...
- 221
3
votes
1
answer
355
views
in / out instructions - how should I treat this?
I see a lot of in and out instruction in IDA. I know what those are supposed to do, but I do not know how to treat them and I'm making no advancements in understanding the code.
Short example:
First ...
- 317
3
votes
2
answers
183
views
Are some special chars(<>) in function names not supported by windbg/cdb?
I have a function in a binary like this class<class1::class2>::function. I can't directly use commands like bp, u, x on the function. The only option I have right now is x class* and then look ...
- 2,629
3
votes
2
answers
2k
views
Automated Assembly/Disassemble library
I'm writing a handy reverse tool in C++ with manual assembling/disassembling shell, to automate my work!
I need an assembler library.
Is there any library, embedding in C++?
- 291
3
votes
1
answer
425
views
What is the format of this date time?
I've been writing a small library to allow parsing of the data files used by Sage Accounts 50, but I'm really confused by how it is storing dates.
I'm fairly sure that there will be a date created ...
3
votes
2
answers
602
views
C++ Unary equals (unary operator=)
In C++ binaries, I find Qt methods like ??4QString@@QEAAAEAV0@AEBV0@@Z which demangle to
public: class QString & __ptr64 __cdecl QString::operator=(class QString const & __ptr64) __ptr64
or ...
- 131
3
votes
2
answers
1k
views
Arm ldr diffrent between # and =
In ARM assembly, what is the difference between
ldr r4, =0x44454433
and
ldr r4, #0x44454433 ?
- 49
3
votes
1
answer
143
views
Confusing syntax found in malware
I am confused by what the following command is doing:
00401234 mov dword [esp+0x35], sub_408678
For context, I'm reversing a piece of malware and am using Binary Ninja, which to my knowledge ...
- 31
3
votes
2
answers
1k
views
Is pointer decryption possible?
I’m pretty new to reverse engineering, so bear with me...
I’m trying to get a few struct definitions (or whatever they’re called) from this one binary. After some time fiddling around with it, I’ve ...
- 33
3
votes
1
answer
787
views
Strange instructions pattern (lw) in MIPS binary
I'm trying to reverse a binary and I'm having trouble understanding a pattern that keeps showing in almost half of the functions in the binary.
This is how one particular function looks like:
Why is ...
- 287
3
votes
3
answers
7k
views
Speedport entry 2i zte home router's firmware
I was searching through my routers admin page some time ago and I've noticed that it doesn't support firmware updates by the user(it's an ISP's speedport entry 2i router(zte variant)). So long story ...
3
votes
1
answer
736
views
Computing subtracted stack space for a function manually
Lets assume this function frame :
How to calculate and check if subtracted stack space by line 3 is 58h ?: sub esp, 58h
And this is the code, the compiler is also Dev C++:
#include <stdio.h>
...
- 139
3
votes
4
answers
458
views
Search remote malware zoo for homologous samples
I've got the following problem:
I'd like to find new binaries of a certain malware family -- unpacked -- for subsequent analysis (active C&C comms analysis).
Is there a database of binaries ...
- 233
3
votes
1
answer
2k
views
Date and time data extraction from a hex dump
I am trying to retrieve date and time data from a hex dump. I found following entries that has entry id and date time information in it. But, I am not sure about which offset it is.
60 03 00 00 00 F1 ...
- 131
3
votes
3
answers
1k
views
Finding end of file
I have got a file which contains other files. I know where the subfiles start (header) but how do I know where the subfiles end ?
Edit: Files are like: sound files (.wav) and images (.bmp, png, jpeg)
...
- 33
3
votes
1
answer
7k
views
Dumping the GOT with gdb at run time
I want to see how the plt stubs are being resolved at run time when lazy linking is used and how the GOT is changed along the way. How can I dump the GOT with gdb?
- 407
3
votes
1
answer
4k
views
Binwalk does not show anything when process binary
I tried use Binwalk to extract content of binary firmware image dumped from flash, but Binwalk does not show anything.
I tried commands
binwalk -Me file.bin
binwalk --dd='.*' file.bin
strings ...
- 215
3
votes
2
answers
71
views
Finding a particular call to an offset within a vtable using pattern matching
Let's say I have a very simple pattern I'm looking for. E.g. the following regex,
mov.*(eax|edx|ecx|esi|edi), \[(eax|edx|ecx|esi|edi)\+30h\]
Now, I'm also looking for references to this in which the ...
- 131
3
votes
2
answers
332
views
Problem with converting hex values to decimal
I'm reverse-engineering custom binary file format. I'm using 010 Editor to check this file. I found data structure to represent UTF-8 strings, which has header section of one or two bytes in length ...
- 33
3
votes
1
answer
3k
views
Check if binary was compiled with security checks (/GS)
I have to check massive amount of binaries whether they were compiled with the /GS option. I assume a good indicator would be to check if they have stack cookie or not. Do you know any tool that can ...
- 2,038
3
votes
1
answer
1k
views
OllyDbg: Keep comments & labels in rebased DLL
My program loads and unloads a DLL of main interest at runtime.
I try to add comments and labels to the DLLs code, but when it is unloaded and loaded again, they are gone, as the DLL is rebased most ...
- 1,083
3
votes
1
answer
58
views
GNU strings with --encoding=S
I have two binaries. Both contain the string "precondition failed" (without the quotes).
The corresponding byte sequence 70 72 65 63 6C 65 64 00 is the same for both binaries. However, the ...
- 1,550
3
votes
1
answer
670
views
U-boot base address on Ghidra
I'm trying to do some REing on a vendored U-Boot bootloader image.
For context, the U-Boot image was extracted from the full firmware image with:
dd if=<firmware>.img of=uboot_sdcard.bin bs=1024 ...
- 193
3
votes
2
answers
132
views
How to figure out functionality when doing Static Code Analysis in ASM?
When doing Static code analysis on a disassembled app, I usually end up seeing many calls to registers (CALL EAX for example), which is constructed in runtime, which leaves me clueless on how to ...
- 31
3
votes
1
answer
264
views
Importance of learning file structures for reverse engineering?
I'm new to reverse engineering and I have started to study the anatomy of specific file formats, specifically PE right now. I really enjoy learning the different parts of the files and the different ...
- 105
3
votes
1
answer
520
views
custom virtual machine protection
How someone would go to reverse engineer a sample protected with a virtual machine? The problem is that it's not opcode anymore it's bytecode which I don't have any idea about because it's a private ...
- 163