Questions tagged [binary-analysis]
The process of gathering information about a binary file, either with static or dynamic methods.
537
questions
2
votes
1
answer
670
views
What kind of data is this within this 3D mesh file format?
I am reverse engineering a 3d file format for a game. I know the file is a mesh since I was able to identify the XYZ Coordinates for each vector as well as the MeshFaces. Each Vector XYZ Coordinate ...
2
votes
3
answers
661
views
What exactly do assemblers translate macros into?
I have dug in simple binaries, such as though like x86 bootloaders, Sega video game binaries, etc. I know that these files tend to use assembler macros to define data, etc. What I am having trouble ...
- 29
2
votes
2
answers
82
views
Decoding a list of integer values in unknown format
I'm attempting to reverse engineer a binary file format which is used to encode a list of integer values. I can't work out how this format works, as the number of bytes used to encode each value ...
- 73
2
votes
1
answer
1k
views
How to call a func in an executable binary?
I have a binary with a func that I can disassemble. What are simple ways for me to call it with arbitrary args and observe its return val and behavior?
Ideally, I'd like to do this:
Within gdb (or ...
- 187
2
votes
1
answer
421
views
Not able to understand the C-switch statement in disassembly
While I'm trying to disassemble my own C code I am stuck in a problem of not understanding how this Switch statement is implemented in assembly code. Can anyone please help to figure it out? This the ...
- 323
2
votes
2
answers
374
views
C++ structure containing a RTTI getter function?
I'm working on reversing a C++ application and I've come across a structure that contains a getter function that returns TypeDescriptor*, I've read some articles on RTTI and reversing C++ but can't ...
- 103
2
votes
1
answer
181
views
Breakpoint in GDB hit 144 times before first call to function
I am working on a reverse engineering challenge and have a binary file. I know how to get the flag by changing the instruction flow after doing a strcmp so I jump to the function that prints the flag....
- 21
2
votes
1
answer
495
views
Why can't I decode this UART signal?
I have a modem that I'm trying to get into. It's composed of two SoCs, both with UART headers. I was already successful trying to connect to the first SoC's UART, with my USB-to-UART CP2102 decoder ...
2
votes
1
answer
436
views
obtaining string value from Unknown elf-x86-64 binary with gdb
I'm trying to find a string value stored in memory by a binary (possibly written in C) that won't show up when I perform "strings a.out". I have tried examining particular memory addresses of interest ...
- 21
2
votes
1
answer
2k
views
No apparent entry point for stripped, PIE binary using radare2
I am running on 64-bit Windows 7 and am using radare2 to attempt both static and dynamic analysis of a binary executable. The issue is that I cannot seem to find the entry point of where the program ...
- 131
2
votes
2
answers
215
views
How can I find the buffer of CryptGenRandom?
I am trying to analyze the CryptGenRandom algorithm on my Windows 10 laptop.
According to Niels Ferguson's Whitepaper called 'The Windows 10 random number generation infrastructure', the ...
- 83
2
votes
1
answer
96
views
Need help decoding bytes to number
I've got a really really old file format from an accounting software, late '70s, DOS, QBasic or QuickBasic. Source code is lost, only .exe file remaining, file needs emulator.
The file formate seems ...
- 141
2
votes
1
answer
164
views
Reversing uboot on an aarch64 Hi3559AV target problems
I am trying to reverse uboot for an ARM aarch64 Hi3559AV target.
I've dumped the binary uboot.bin.gz, and have loaded it in IDA at the correct address. IDA seems to see a lot of strings (and ...
- 83
2
votes
1
answer
566
views
Identifying the nature and contents of a file
As a preface, I do not have any experience in reverse engineering. I am an application developer, so this field is way out of my area of expertise. My end goal is to create a web page out of this ...
2
votes
1
answer
96
views
Is there a standard documentation format for file formats?
I'm analysing an undocumented file format. Is there a standard documentation format for file formats I can write up? Something of this level of complexity and detail? What I have in my mind is,
!...
- 177
2
votes
1
answer
703
views
Radare2 does not display the entire assembler code
I am trying to solve this ELF - Ptrace crack me. Here are the commands I use :
I start radare2 with the crack me as argument.
radare2 ch3.bin
I decide to go to the main and print the assembly code ...
- 221
2
votes
1
answer
1k
views
How to reverse engineer a Black Box?
I am trying to reverse engineer / research a black box system, this is, a system for which there is no public information at all. Let's say the system is a modern handheld console.
I have already ...
- 154
2
votes
1
answer
3k
views
Decoding binary data structure
I have these data files that are generated by a tool which was distributed by a company that is long defunct. I have been taking it apart with a binary file viewer (freeware from Proxoft, it is a ...
- 23
2
votes
1
answer
15k
views
Need help extracting JFFS2 filesystem from .img firmware binary
I'm trying to access the filesystem of the EA2750's firmware. Here is a link to download it http://downloads.linksys.com/downloads/firmware/FW_EA2750_1.1.7.172380_prod.img. The problem is it is an img ...
- 35
2
votes
2
answers
588
views
Need help unraveling the format (time, string, float/decimal, integer/float/decimal) in .dat file
The files (idx, dat) are from a plant/facility operational historian. The .dat file is supposed to have entries, each with identifier (tag name/id/key), value (decimal/float) for different times (...
- 21
2
votes
1
answer
737
views
How to adjust function type/call parameters to custom structs in IDA Pro?
I'm trying to reverse-engineer a function in IDA Pro that was originally identified by IDA as such (I was able to rename it into Device_CreateCloseIoControl):
but I know that this function was ...
- 1,639
2
votes
1
answer
2k
views
Firmware-mod-kit says "No supported filesystem" along with strange and long output
I tried firmware-mod-kit's extract-firmware.sh script and I receive the following output which ends with "No supported filesystem found".
The firmware belongs to the TL-WR740Nv5 router.
The ...
2
votes
1
answer
1k
views
Given a program binary, how can I know which compiler it is compiled from?
Basically I have a set of 32-bit ELF program binaries compiled by either gcc or llvm. They are all stripped before analysis.
My question is that, given a binary, is there any way I can determine ...
- 2,475
2
votes
1
answer
2k
views
What are the open source symbolic execution tools for windows binaries
I want to test some approach in symbolic execution in windows binaries and doesn't want to write a new one from scratch and also this tool must be reliable at research levels.
I found S2E and ...
- 123
2
votes
1
answer
411
views
Missing addresses from relocation section of ASLR enabled PE binary
I'm analyzing entries in the relocation section of a binary. In particular, I want to know if all the targets of jumps have a corresponding entry in the relocation section. The screenshot shows the ...
- 67
2
votes
1
answer
569
views
Trying to reverse a bin file
I'm trying to reverser a bin file with Ghidra, without success for the moment, I can't find any functions in the decompiled file.
he bin file is for an ARM 32bits, I'm pretty sure this is an stm32, so ...
- 131
2
votes
1
answer
80
views
Radare2 only printing out the last byte at RSP when using pxq @ rsp
According to documentation,
px[?][owq] [len] hexdump of N bytes (o=octal, w=32bit, q=64bit)
and
pr[?][glx] [len] print N raw bytes (in lines or hexblocks,
'g'unzip)
These two ...
- 63
2
votes
1
answer
321
views
Proprietary 3D Format Reverse Engineering: What Could These Numbers And Matrices Represent?
I'm trying to reverse engineer a model format from an older Russian game (Pathologic) with limited success. It is a proprietary model format not recognized by any converters/editing tools (believe me, ...
- 21
2
votes
1
answer
561
views
How to extract information from a binary file knowing the target info
I have some measured data comes from a various types of sensors. The sensors are connected to a data-logger in order to store measurement data. After measurement, the data transported and stored in a ...
- 23
2
votes
1
answer
340
views
Getting android app from device for reversing - what if there are multiple apks?
For analyzing and reversing android apps, where the target app is installed on an android phone, usually there is a base.apk file on the device, and there are various ways to find this apk file on the ...
- 474
2
votes
1
answer
3k
views
How to set the type of a variable or function to an std::string?
I'm using IDA Pro and have identified a function that takes an std::string as an argument.
However when I click on the function and "Set Item Type", entering its definition:
std::__ndk1::...
- 121
2
votes
1
answer
335
views
Finding "func main" in a stripped binary written in GO
I'm reversing a binary that was apart of a CTF I was involved in about a month ago. It was too large of a binary to do during the challenge so I am doing it now.
I am having trouble finding the main ...
- 105
2
votes
1
answer
542
views
How can I determine a module to which function is related with IDA Pro
For example I have a function sub_7FFA95D8F120. I've checked out Views->Segments which shows .text segment. It seems that I am missing out something important. It would be great if someone explained ...
- 23
2
votes
2
answers
845
views
GetProcAddress with 0 as lpProcName
I'm reversing a 32bit binary for a challenge I got at a college lab and I'm having a hard time trying to understand the intent of the asm code.
The binary is a 10 level reversing game where you get ...
- 133
2
votes
1
answer
434
views
ROP chain: Buffer Overflow Return Pointer
I am trying to get a ROP exploit to work on Ubuntu 18.04 LTS 64bit.
I have a 64 bit binary (Nx enabled, ASLR disabled) with vuln function as follows:
public vuln
vuln proc near
var_100= byte ptr -...
2
votes
1
answer
98
views
Detect interesting testcases
Suppose I have a ton of test cases and my target is closed-source. Well, I need to know which test cases discover new path in the execution of my target and which are duplicated. I know I have to use ...
- 21
2
votes
1
answer
1k
views
File analysis with hexdump - unknown container
I have a backup file, generated by an android phone. However, I don't know the file type or how to extract the contents without the original software. I've tried to search for common file headers ...
- 21
2
votes
1
answer
364
views
Trying to reverse engineer teamviewer's printer driver
Unlike LogMeIn or GoToMyPC, TeamViewer does not have any driver files except for the INF and GPD files. LogMeIn and GoToMyPC have their own configuration and driver dlls, while TeamViewer uses the ...
- 121
2
votes
1
answer
907
views
Analyzing a Login Process
I am reverse engineering a program that uses a custom auth protocol. This is a basic outline of the process:
Client takes input for username and password, then sends username to the auth server.
Auth ...
- 151
2
votes
1
answer
1k
views
How to reverse engineer a database file format?
It is an accounting database whose database file format is proprietary data. But the problem is the database is highly unreliable, corruption go unnoticed for years after which it becomes unbearably ...
2
votes
0
answers
647
views
Please help identify which type of CPU architecture is used on obscure portable media players
I am trying to reverse engineer a media player with obscure SigmaTel SoCs just for fun but I didn't find very useful information.
As far as I don't know exactly what CPU architecture is used on these ...
- 21
2
votes
0
answers
65
views
Buffer overflow gets() weird parsing
I'm attempting to do a buffer overflow with gets(). I've figured out how to write over the return address and I'm able to do so, however, I cannot write in the address I need because the 0x7F at the ...
- 21
2
votes
0
answers
38
views
Find out what is this binary database entry and what format it is
the following varbinary "BUFFER" of a database entry is for an article.
FIELD_0 is in plain text and the item name is "1", which I created with the item management software.
[...
- 21
2
votes
0
answers
49
views
How to obtain import name from disassembled assembly
I'm trying to create my own tools for reverse engineering PE. I have some assembly codes that I fetched from a clone of objdump for a program. Sometimes I see call instructions such as :
callq *...
- 21
2
votes
0
answers
46
views
How to get the APIs present in a particular block in a CFG using Angr?
I'm doing binary analysis based on Control Flow Graph (CFG). As I suppose to get the APIs from every block in the CFG. I'm finding it very difficult to do so using Angr as I don't have enough grip on ...
- 39
2
votes
0
answers
43
views
LZ4N file format - file decoding
I'm trying to decode a file that is part of device firmware. Unfortunately it comes RIFF<...>WAV format wrapped / packed with strange LZ4-like format.
Non of linux available lz4 tools do ...
- 21
2
votes
0
answers
552
views
Firmware Binary Reverse with Ghidra returns only few codelines decompiled with truncated code
I have tried to decompile the firmware binary of a microcontroller that should be an STM32 (but I'm not sure about this).
After the analysis I get only few codelines with a lot of similar messages:
...
- 121
2
votes
0
answers
81
views
jump to invalid address when emulating
I am currently working on a deobfuscation tool for a Windows Driver (which is obfuscated). I am using Capstone to disassemble and Unicorn to emulate. I have run into a weird issue where the indirect ...
- 41
2
votes
0
answers
6k
views
Extracting ZTE F670L router's config.bin file
I want to enable telnet in my router (ZTE F670L V9.0.11P1N20D), So, I backup my router and i have a file config.bin, Size 23.5KB. I fired up kali and when i issue this command:
$ file config.bin
...
- 21
2
votes
0
answers
92
views
nrf52-based localization tag flash dump and modification
Lately I've bought a localisation tag (Apple AirTag alike). When I click a button on my cell phone, the device plays a chiptune-like ringtone. The ringtone is configurable using the app and stored on ...
- 21