Questions tagged [binary-analysis]

The process of gathering information about a binary file, either with static or dynamic methods.

Filter by
Sorted by
Tagged with
2
votes
1answer
3k views

How to decrypt the config.bin from ZTE ZXV10 H201L

I have this file from my router its backup of user config,I suppose its compresed with zlib and encrypted with AES. Utility which is resposible to compress it and encrypt it is called cspd. In side ...
2
votes
0answers
603 views

Reverse engineering TPMS sensor data [closed]

I'm trying to reverse engineer data received from TPMS (car tyre pressure) sensors. I used rtl_433 tool to capture the data from sensor at 433 MHz. Tool was able to detect data is using FSK modulation ...
2
votes
0answers
100 views

How can I further identify a file which the file command lists as 'data' [closed]

I have file named 'out'. If I issue the file command I see : :~/Desktop# file out out: data How can I further identify what type of file this is? Interestingly, if I execute the file, I see a '...
2
votes
0answers
881 views

IDA Pro user-defined offsets (again)

I'm disassembling a simple Z80 program and can't for the life of me work out how to - successfully - specify a user-defined offset. I have a line of code as: ld de, #0x6058 and FTR, this address ...
2
votes
0answers
60 views

How to know the C++ try/throw/catch block size and address from machine code? [duplicate]

I'm doing a project that reorders basic blocks inside a function at runtime in C++ under 64-bit Linux. The reordering process includes updating instructions like "jmp". One problem is that if the ...
2
votes
0answers
223 views

What is the difference between Software Architecture Recovery and Software Remodularization in the context of Reverse Engineering?

In the reverse engineering scenario, after extracting a representation of the code, it is often useful to recover/ reconstruct the architecture of the software (for eg. when reverse engineering java ...
1
vote
2answers
4k views

How to find how global variables defined in binary

In Visual Studio I have written simple code, int pranit = 2; int& sumit = pranit; int main(int argc, char** argv) { sumit++; return sumit; } I used OllyDbg to Disassamble, but I am not ...
1
vote
1answer
230 views

Way to get all the function prototype using Ghidra

I have been trying to extract the function prototypes from a binary file using Ghidra. Up till now what I have done was to use Ghidra's included "Decompile" script and filtered out the function ...
1
vote
1answer
2k views

reversing stripped & statically linked binary with radare2

As the question says I need to reverse a stripped elf binary with radare2. This binary is also statically linked. I already reversed it in IDA by identifying statically linked libraries using lscan ...
1
vote
1answer
2k views

Simple carving of zip file using binwalk

I have been trying to use binwalk on a very large dump file without much success so far. Everytime I tried to use it, it produces very large zip file that fill the disk until I reach a disk full error ...
1
vote
2answers
605 views

What is the address of main() and how many bytes does it allocate on the stack for its frame size?

Here is my objdump -d output but I do not know where to look. I understand assembly but it is a little confusing trying to find out what the values of registers are at certain points. If anyone knows ...
1
vote
1answer
10k views

extracting data from binary file

I have a binary file and a text file of the corresponding data, and I know the location in the binary file where the data are contained. However, I am unable to determine in what manner the data are ...
1
vote
2answers
780 views

Is it possible copy and save bootloader using CLI telnet commands?

I need get copy of original Bootloader from device running embedded Linux. Is it possible copy and save bootloader using CLI telnet commands? I have full access to CLI interface. Is there way copy ...
1
vote
2answers
876 views

Understanding packet byte structures with OllyDbg

I have written a small dll that detours the function that decrypts and encrypts game packets allowing me to see the packets being sent and received. Packets like login are easy to structure because ...
1
vote
1answer
200 views

Decryption loops

I'm reversing a CTF binary and I found a decryption loop decompiled by IDA like this: for ( i = 0; i < n; ++i ) { v22 = *((_BYTE *)sub_5657D89B + i); v0 = v22 ^ 0x90; v1 = strlen(&...
1
vote
3answers
3k views

What to do with .dd files? [closed]

Okay so I am doing picoCTF and I am very new to ctf. Now in one of the questions I am given a .dd file and the hint says Some files have been deleted from the disk image, but are they really gone? I ...
1
vote
2answers
106 views

Test malware files in host machine?

To analyze malware files we are using virtual machine and virtual box but some of malware detect the environment and will not do its work properly. I want to know how to test malware files with out ...
1
vote
2answers
858 views

binwalk cannot find gzip sections

I am starring at the following exe file, see main page here. It seems pretty clear (using -E entropy option) that the exe contains compressed section. For some reason binwalk is not capable of finding ...
1
vote
1answer
315 views

Variable liveness analysis on binaries

I want to detect all the variables live at any instruction/address in a binary. By variable, I refer to both global as well as function local variables. In other words, given a Linux ELF and a virtual ...
1
vote
1answer
254 views

Where can I learn about code instrumentation?

Currently I am learning about profiling parallel programs. All the profilers heavily use all kinds of instrumentations but this topic is not well explained. Do you know any good sources from which I ...
1
vote
2answers
469 views

What Can Be a Fast Way to Count Basic-Blocks Dynamically?

I am trying to add basic-block counting to a static analyzer. This analyzer itself uses PIN as default tool for this kind of works. So, I wrote a pintool for counting basic-blocks. But, when I try to ...
1
vote
1answer
803 views

How to change PE signature? [closed]

I'm looking for a way to recognize an executable file as a NullSoft installer. I´m trying to prove that a malicious software is capable of changing the PE signature so we can not trust in some tool ...
1
vote
3answers
563 views

What exactly do assemblers translate macros into?

I have dug in simple binaries, such as though like x86 bootloaders, Sega video game binaries, etc. I know that these files tend to use assembler macros to define data, etc. What I am having trouble ...
1
vote
1answer
125 views

Deciphering an unknown graphics format

For my own amusement, I dumped the files of an old Nintendo DS video game I have (the company has long since gone bankrupt/closed) and am trying to extract the assets. I have recovered game text, ...
1
vote
1answer
126 views

Identifying Compiler Used for Binary File

I am trying to recreate a binary file from an analysis of "strings" output. I don't recognize which compiler was used for this file. It does not seem to be shc. Does anyone recognize this output ...
1
vote
1answer
73 views

What type of function gets called using a register instead of address in the binary? how to find the address statically?

So I'm trying to write a reversing tool right now and trying to make a CALL graph the problem I'm having is some calls are like Call *eax instead Call 'address' I can easily generate the call-graph ...
1
vote
2answers
169 views

Emotet invoice, what is the embedded file inside the word document

This pastebin hosts current URLs hosting the fake invoice of Emotet malware, which is the dropper part of the malware. The document is a Office Open XML, and there are two large non textual segments ...
1
vote
1answer
147 views

rip adress not visible with dr command

I just finished this challenge. This is the content of main function : [0x08048a86]> pdf / (fcn) main 417 | main (int argc, char **argv, char **envp); | ; var int local_16h @ ebp-0x16 |...
1
vote
2answers
80 views

Getting a high level overview of comparative size differences of binary files?

I have two binary files, one of them is pulled from Protostar's (stack0 example). The other one I compiled (from source) with the latest version of GCC. The size difference is massive. My version is ...
1
vote
2answers
120 views

How is the IV generated from a timestamp based on this function?

Background: I am currently looking to make some diagnostic software interoperable with other software, but all communication that occurs in this software is encrypted with AES-128-CBC. A sample ...
1
vote
1answer
853 views

Could not find ld-linux-x86-64.so.2 in strace output

I did a ldd on /bin/cat and I see that dynamic loader library /lib64/ld-linux-x86-64.so.2 is a part of it. ldd /bin/cat linux-vdso.so.1 (0x00007ffe743f4000) libc.so.6 => /lib64/libc.so.6 (...
1
vote
1answer
1k views

Trying to identify a string in a strcmp instruction

Working to debug and analyze a piece of firmware, I've come across a bunch of cgi files which are all symlinked to a central cgi file. The first thing the main function does is run a series of string ...
1
vote
2answers
171 views

Figure out whether a function has return value of not?

I am doing binary analysis on x86-64bit ELF binaries. All the binaries are compiled from C language. Basically, for a given function, I would like to figure out whether this function has a return ...
1
vote
2answers
405 views

How hard is it to interpret binary data of a new and unknown format, if it's unknown what data is encoded?

This question is based off of my answer to a world building question: https://worldbuilding.stackexchange.com/questions/30471/how-could-a-blind-alien-race-interpret-video-broadcast-into-space/30497?...
1
vote
1answer
457 views

Binary Instrumentation of malware binaries?

I am developing a dynamic instrumentation tool using Intel PIN to analyze malware binaries in windows. From what I have learned so far is that I am able to use the tool with programs I write using C/C+...
1
vote
3answers
702 views

Dump global datas to disk in assembly code

the experiment is on Linux, x86 32-bit. So suppose in my assembly program, I need to periodically (for instance every time after executing 100000 basic blocks) dump an array in .bss section from ...
1
vote
1answer
758 views

Cannot find the caller of the main function in a disassembled firmware

I am looking at an unstripped ARM elf firmware file using IDA Pro. There is an init() function and a main() function. From my understanding of the logic, it's probably structured like this: init() ...
1
vote
1answer
259 views

Directed call inside recv

In tracing how the recv function works on Windows, I observe the following trace: ... 0x743817d2 push eax C:\windows\system32\WSOCK32.dll recv 0x743817d3 ...
1
vote
1answer
63 views

Statically Reverse Engineering Shellcode - IDA to Ghidra

I'm trying to follow along with this tutorial which is using IDA in it's example. https://0ffset.net/reverse-engineering/malware-analysis/common-shellcode-techniques/ Hash: ...
1
vote
1answer
63 views

Confusion between different ARM architectures

I am trying to develop a machine learning model to help with the process of reverse engineering. As the first stage, we are currently trying to train an embedding model that understand the ...
1
vote
1answer
243 views

Reversing a key-gen firmware for RISC-V

I would like to study this firmware for Sipeed MAix, a RISC-V development board. You can download it here: key_gen_v1.2.zip. As the name suggests, its purpose is to calculate and print a "machine key"...
1
vote
3answers
187 views

What is the difference between malware that is 'dumped' and one that is 'unpacked'?

On malware sharing communities, I have been noticing that the samples shared are marked as unpacked or dumped. I have tried to load the dumped malware in IDAFree, however, there is nothing in the ...
1
vote
1answer
561 views

How to find the starting address of main function when the binary is stripped and _start doesn't push the absolute address value of main?

So let's say the ELF binary is stripped - meaning no symbol table - and the _start function doesn't push the address of main before calling __libc_start_main. This happened in a binary when compiled ...
1
vote
1answer
126 views

Best python framework/library for constructing the call-graph from binary?

So i have written a python tool using capstone that disassembles the code section of a ELF binary using capstone. now i want to also create and show the call-graph of this binary in a dot format, I ...
1
vote
2answers
129 views

Calculation with not defined variables?

I am new to reverse engineering and try to solve a crackme with radare2. My problem is understanding of the following lines: | 0x000007a9 c745b8000000. mov dword [var_48h], 0 | ...
1
vote
2answers
583 views

pwntools shellcode narnia2

I'm trying to solve the narnia2 challenge on overthewire. I read a guide for help and managed to overwrite the stack with A's using some python $(python -c "print 'A'*132 + '\xef\xbe\xad\xde'") ...
1
vote
1answer
2k views

Impossible to execute a program with radare2 : TO DO continue

I am trying to crack a crackme. I already catch the flag because I seen the string variable which represants flag. I would like to catch the flag on an other way, I want to set a breakpoint when there ...
1
vote
1answer
2k views

How to convert Unexplored data in IDA Pro to code?

I am analyzing a malware, it has a lot of confusing methods, I wrote an idc script to remove confusion, use the MakeCode() function to convert some Unexplored data into code, but there are still some ...
1
vote
1answer
601 views

What is the difference between stripped binary and obfuscated binary

I want to know the difference between stripped binary and obfuscated binary.
1
vote
1answer
111 views

Why would an ELF SHT_REL section contain relocations outside the section its sh_info refers to?

I have a .so from an Android JNI/NDK application. Here are two of its sections: [Nr] Name Type Addr Off Size ES Flg Lk Inf Al [10] .rel.plt REL ...

1
3 4
5
6 7
9