Questions tagged [binary-analysis]
The process of gathering information about a binary file, either with static or dynamic methods.
536
questions
3
votes
1
answer
198
views
Debug point not hit with radare2
I am doing this reverse engenering challenge. I executed theses commands to analyse the main function :
radare2.exe ch15.exe
aaa
s main
pdf
This is the output of the pdf command :
[0x004017b8]> ...
- 221
3
votes
1
answer
824
views
How to add new language to ARM firmware
I have piece of firmware (download from here) and I need to get access to its filesystem.
Here is the output of a binwalk scan:
root@kali:~/Desktop/E1200YDXNB1_OLAANB1# binwalk --dd=".*" ps.bin
...
- 31
3
votes
1
answer
2k
views
IDA Pro only recognizes my files as BINARY
I am trying to disassemble some various files, and IDA does not recognize them. Is there anyway to add more file types to IDA Pro? I am running ida 6.5
- 495
3
votes
1
answer
340
views
How to reverse Engineer a Struct in IDA Pro?
How to identify and define a struct in IDA pro Decompiling during reverse engineering?
Please explain the easiest way to figure out the struct in IDA Pro decompilation!
To make life easier are there ...
3
votes
1
answer
132
views
What type of bin is this file?
Can someone help me what type of BIN file is that and can i read what is inside ? Thanks
https://easyupload.io/673djh
- 31
3
votes
1
answer
398
views
What is data only exploitation?
I was wondering, and after trying to read for the past several months I got totally lost and don't understand this concept. Could someone please explain in simple words the concept of data only ...
- 31
3
votes
1
answer
349
views
Reverse engineering Roland TR-8S kit file format .t8k
I'm trying to figure out the file format that the Roland TR-8S drum machine uses for importing/exporting drum kits. My goal is to replace the sample (PCM) data within a kit. It's a proprietary binary ...
- 133
3
votes
1
answer
2k
views
Defining all undefined functions
I analyzed a binary, and lots of functions weren't detected as such - the bytes weren't detected as assembly. I read about the Aggressive Instruction Finder analysis and used it. Now the instructions ...
- 135
3
votes
2
answers
603
views
Track execution of bytes in a Linux executable
Given a binary executable file (in this case, a compiled C file which finds the gcd of 2 numbers), is there a tool which profiles the execution of this file and could generate some sort of call graph ...
- 31
3
votes
2
answers
331
views
One-pass streaming algorithm for detecting bytecode/opcode?
I am searching for an algorithm and/or snippet of code that provides a one-pass algorithm over a steady datastream that can detect a valid sequence of bytecode or opcode.
There are no PE32, ELF, or ...
- 151
3
votes
2
answers
1k
views
SJ1000 ActionCam firmware
I want to modify the mentioned camera firmware (SJ1000). The binary (.bin) firmware file can be downloaded from archive.org.
I used binwalk to scan the binary, but I'm stuck. The binwalk signature ...
- 31
3
votes
1
answer
1k
views
Advanced Binary Exploitation CTF
I wanted to ask your assistance: Where can I find advanced ctfs (that hopefully contain solutions) regarding binary/kernel exploitation? I am interested on finding x86_64 linux/windows/arm64 that ...
- 56
3
votes
1
answer
251
views
What is actually loaded here and different hexdump outputs on util-linux hexdump and on cutter and ghidra's hexdump
I was trying to understand what segment of file gets loaded by fourth LOAD header on phdr array.
First 6 headers are shown below from readelf
Program Headers:
Type Offset ...
- 133
3
votes
1
answer
773
views
Remove Binary from IDA Database
I saw the File -> Load File -> Additional Binary File option and tried it out. Now I want my original IDA database back (with just one binary), but can't afford to lose the comments I have saved ...
- 131
3
votes
1
answer
112
views
How would one find test cases for a self-implemented value set analysis (VSA)?
I read a blog post about value set analysis (VSA). For VSA, see e.g. here.
The blog author writes
I’ve been trying to get to the point where the example in
Balakrishnan’s dissertation works. I ...
- 1,550
3
votes
2
answers
3k
views
Intel Pin memory operations tracking
I am using Intel Pin in order trace memory activity of an executable on Windows. What I have found, that most of the memory operands (Read or Write) operates with 2 or 4 bytes. So I decided to modify ...
- 124
3
votes
1
answer
449
views
Trouble analyzing a ransomware
I got this fake-av sample , and I want to reverse it . But the problem is that it exits after few commands . Here are the steps :
When loaded in Ollydbg it pauses at:
00401000 > $ 8D9404 7713210&...
- 31
3
votes
0
answers
148
views
PEStudio DLL analysis: flag in export section
I start to use PEStudio for DLL analysis; I understand (more or less) everything, except the "exports (flag)" section:
What does it mean the X in the flag column? So, what is a/the flag?
...
- 131
3
votes
0
answers
55
views
How can I quickly tell which ARM Thumb version a particular piece of code is using?
I'm working with an ARM processor: an STM32F407VGT6 board, which IIUC powers a 32-bit Arm® Cortex®-M4. I need to inspect the binary weight of some instruction, so I used objdump like this:
arm-none-...
3
votes
0
answers
371
views
Reverse-engineering the Sony Camset (Camera Settings) file format
Context
Newer Sony cameras have functionality that allows them to:
save the current camera settings (shooting mode, auto-focus mode, etc.) to a file
load the camera settings from a file into the ...
- 161
3
votes
0
answers
695
views
Find constant variables with float values using Ghidra
I dumped an il2cpp.so with il2cppDumper and in the dump.cs I found that the variables I wanted to change its values are somewhat constant float. this is the snippet:
// Namespace:
public class ...
- 299
3
votes
0
answers
468
views
Modify bin firmware file of an old phone
I am trying to remove/disable some system apps ( Messages, Games, Radio or Calendar ) and remove/replace the boot screen from samsung E1200y.
So i start searching for the way to do that...
I used HxH ...
- 53
3
votes
0
answers
1k
views
Reverse-engineering DOS game's data files
I would like to figure out the data format used by an old DOS game I used to play when I was a kid. That link includes a full download for all the files and it runs fine in DOSBox if you want to try ...
- 131
3
votes
0
answers
2k
views
Analysing eCos image
I'm working on unpacking a firmware image. I've already uncompressed the original image, but I'm stuck in the current step.
This is the current uncompressed image:
https://www.dropbox.com/s/...
- 31
3
votes
0
answers
441
views
How is the tp-link switch firmware obfuscated?
I was curious and wanted to learn a bit about TP-Link's switch firmware (for example: What OS are they using?). Because I have seen the sg3216 in the real world, I thought, I'd start with that one.
...
- 131
2
votes
1
answer
10k
views
Reverse Engineering a Firmware. Someone can help me?
I am currently trying to reverse-engineer a firmware file to learn the topic but I am a little bit stuck.
I tried to use binwalk to get more information about the file but this did not produce ...
- 31
2
votes
2
answers
365
views
Dynamic analysis of malware samples
I have thousands of Linux malware samples in ELF format. And I am thinking to use dynamic analysis (say, PIN) to obtain an execution trace of each malware sample.
However, I am afraid such activity ...
- 2,475
2
votes
2
answers
1k
views
Unable to extract IP camera firmware
I am trying to extract the firmware for a Panasonic WV-S2131L ip camera. It comes as a .zip file that contains a .img file. I have tried many methods to try to analyze this file and I have found ...
- 21
2
votes
1
answer
612
views
Visual studio memory allocation reverse engineering
I compile this code with Visual studio 2010 compiler:
#include "stdafx.h"
#include <iostream>
int main() {
int *p;
p = new int(255);
delete []p;
}
The disassembly of it, is different ...
- 139
2
votes
1
answer
2k
views
idapython find functions that contain a loop
How can I color functions that contain loops in IDApython ?
If the end of the basic block can jump to start of basic block it's good enough, even in the rare case this is not a loop. But how do i ...
- 21
2
votes
2
answers
554
views
gdb shows that EBP contains a value other than some address(which is what it is supposed to contain). How is this possible?
I am fairly new to RE and Binary Exploitation, I have learned basic assembly instructions for Binary Exploitation and I was doing Protostar exercises (stack0) in which I have to simply overflow the ...
- 23
2
votes
2
answers
1k
views
Wrong RVA values inside IMAGE_IMPORT_DESCRIPTOR
I load the entire PE into an std::vector<Byte> fileContent using std::fstream.
Then I obtain the executable's dos header:
IMAGE_DOS_HEADER* imageDosHeader = (IMAGE_DOS_HEADER*)fileContent.data(...
- 175
2
votes
3
answers
2k
views
About the VB P-CODE mode reverse-engineer
I have to reverse-engineer a VB P-CODE mode program. I had the program's P-CODE, but I don't know what it means. For example:
Proc: 421840
421100: 04 FLdRfVar local_0098
421103: 04 ...
- 31
2
votes
1
answer
290
views
Unknown archive format from QNX operating system
We are reverse engineering a QNX system and we have found a small file that is uploaded to the system. It appears to be either a file system image or an uncompressed archive of some sort. We can't ...
- 253
2
votes
1
answer
4k
views
x86-64 CALL opcode + disassembly
Working a basic buffer overflow on a 64bit system and putting together some basic shellcode. The main program does a call to puts@plt. When I disassemble main in gdb, the opcodes show as:
e8 6b fe ff ...
- 205
2
votes
1
answer
2k
views
how to overcome setunhandledexceptionfilter in ollyDebugger?
I am debugging a malware sample which is using setunhandledexceptionfilter() for anti-debugging. I don't know how to handle this.
Can you guys please explain the setunhandledexceptionfilter() anti-...
- 121
2
votes
1
answer
321
views
Ancient number formats (probably fixed-point)
I'm analyzing an rather ancient 3D mesh format (from 1995 or 1996). Inside the files, there are blocks of what I think are vertices.
For example, the following is a direct hex dump from such a part:
...
- 23
2
votes
2
answers
4k
views
Decoding a blob
I have a proprietary file format that is a compressed database file. This database file has a few dozen tables. Each of these tables only have a few records, many of them don't have any records at all....
2
votes
2
answers
458
views
UPX Unpacking tool
Firstly, thank you for your answer.
What is the best unpacking tool to use to unpack - UPX 0.89.6 - 1.02 / 1.05 - 1.24 ->[Overlay] could you please provide a link so i can obtain as such.
Thank ...
- 21
2
votes
2
answers
98
views
Determine Endianess of some ARM binary image?
I have been advised to analyze an ARM binary image from an Cortex M3 (STM32) for training. It has been directly extracted from flash beforehand and passed to me. However it's unknown whether this ...
- 121
2
votes
1
answer
126
views
When would a program normally transfer data between memory and coprocessor?
In the analysis of an ARM binary, when would one normally encounter transfer operations between memory and a coprocessor? These are encoded as the LDC and STC operators.
Would it be common for ...
- 123
2
votes
1
answer
458
views
The Knowledge of Compiler for becoming a good Reverser
I just reached the the topic of Compilers in the book "Reversing:Secrets of Reverse Engineering" So, I want to ask, is the knowledge of Compilers necessary for becoming a Malware Reverse ...
- 323
2
votes
1
answer
1k
views
How do we decompile java so easy?
I have seen a lot of videos where everyone is decompiling the jar files so easily. but I learnt that we cannot decompile any compiled file so easily. I have a little bit of experience in Gidhra. I ...
- 143
2
votes
2
answers
555
views
Prevent Memory Inspection in a Cython program?
Cython is a great way to protect the source code of a Python program. However, memory inspection and memory reverse engineering can still be done to this Cython program.
What are ways to prevent (or ...
- 21
2
votes
3
answers
680
views
Decode synth preset formats for massive (.nmsv) fm8 (.nfm8) and absynth (.nabs)
I'm trying to decode the file formats for Massive, FM8 and absynth VST synths. The file format is binary with several sections. Reason for this endeavour is to convert the above formats to general vst ...
- 23
2
votes
1
answer
422
views
Identifying Compiler Used for Binary File
I am trying to recreate a binary file from an analysis of "strings" output. I don't recognize which compiler was used for this file. It does not seem to be shc. Does anyone recognize this output ...
- 123
2
votes
1
answer
3k
views
Disassembling MIPS 32 version 1 binary with the Radare2 Framework
I am trying to disassemble a MIPS 32 version 1 binary with the Radare2 framework.
Here is the full output of the file command:
ELF 32-bit LSB executable, MIPS, MIPS32 version 1 (SYSV), dynamically ...
- 23
2
votes
3
answers
266
views
Dynamic instrumentation tools which support reverse execution
I am trying to analyze some execution crash information, and to better identify the root cause of memory access error, I would like to reverse execute the program from the crash point.
For example, ...
- 2,475
2
votes
1
answer
162
views
Tracing variable access/usage instructions
There is a great little closed-source freeware Windows program (written in Delphi) that I have been using for years. WinBar shows a little bar above the TaskBar which gives some system information and ...
- 121
2
votes
2
answers
516
views
Binary diffing: Why moving ebx to eax, instead of pushing ebx?
I was doing binary diffing, I want to know why mov eax,ebx is used instead of push ebx.
This is the binary diffing image:
Before patch :
After patch :
- 139