Questions tagged [binary-analysis]

The process of gathering information about a binary file, either with static or dynamic methods.

Filter by
Sorted by
Tagged with
0
votes
2answers
76 views

How does an executable’s static API differ from it’s dynamic API?

Running an executable in Cuckoo sandbox gives me its dynamic API information. How do these API calls differ from their static API information (eg. If I were to just put the executable through IDA Pro ...
0
votes
0answers
52 views

Combine two ELF binaries

Without having access to the original source code, is there a way to combine two ELF binaries with the main() in the first binary pointing to the main() in the second binary ? In other words, I mean ...
0
votes
0answers
35 views

Is there any tool that finds common things like strings among large number of binaries?

So this is really needed in malware analysis, for example if i have 1000 samples from a family and i want to know which strings are common among all of them, it would really help to have a tool that ...
0
votes
0answers
107 views

How to reverse engineer Apple MacBook SMC update firmware image using IDA Pro 7.2?

Alright so I have watched extraordinary presentations videos from three different reverse engineers who hacked the Apple SMC Update firmware: Charlie Miller: https://www.youtube.com/watch?v=...
0
votes
0answers
75 views

How to force IDA to properly parse the ELF header?

Is possible to force IDA to parse the elf file into its appropriate fields without resorting to IDC/IDApython, I mean is there a built-in functionality that I'm missing? For instance it possible to ...
0
votes
1answer
62 views

Need some help and advices as regards as reverse engineering IoT devices

Hi everyone, I saw this video on youtube as regards as reversing IPTV cameras and finding security vulnerabilities: Black Hat 2013 - Exploiting Network Surveillance Cameras Like a Hollywood Hacker I ...
0
votes
0answers
50 views

How can I reassemble a DDS header with the information I have?

I have 2 files which I know for certainty to be as follows: File 1: Includes all of the DDS image data File 2: Includes some data from the header. The data it includes is the width and the height (...
0
votes
0answers
16 views

In Memory Function Enumeration

I tried to look around and find a way to automate function enumeration of a binary, process. To make things simple, what I am referring to is "normal usage" of a program, in windows. For instance: ...
0
votes
0answers
61 views

Jump without jmp near

I need to jump a Hello, I need to jump some lines that lock program in a loop status. i use process hacker to find lines with string in binary but when i find this lines i have not jumps near, in ...
0
votes
1answer
54 views

In IDA, cannot find xrefs to string in ARM little-endian bootloader/firmware

In this firmware that is ARM Little endian. There is two strings : 0x00006953 : Foretrex 701 0x00006960 : Foretrex 601 The issue, is there is no direct Xreft to any of thoses strings ? For the ...
0
votes
1answer
41 views

Convert series of hex digits represented as ASCII-characters stored in a .txt file to raw bytes

I recently extracted a bunch of raw bytes (from wireshark) into a regular .txt file. Because these raw bytes are stored in a text file, all those hex-digits are actually written as ASCII characters ...
0
votes
0answers
41 views

Identify encrypt /decrypt rsa function

I have arm static binary that I know it use RSA. How can I find the encrypt/decrypt function?
0
votes
0answers
175 views

reversing xiaomi update firmware encrypted?

I am playing around with a xiaomi firmware [mijia_4k_0.6.16.02] for a camera Running binwalk on the file I see this output DECIMAL HEXADECIMAL DESCRIPTION ----------------------------------...
0
votes
1answer
98 views

Questions regarding PLT/GOT and statically linking

I am looking at the assembly code of a heap-overflow challenge (heap3 in Protostar) which uses a vulnerability of an old version of dlmalloc to execute the exploit. Below is the assembler dump: ...
0
votes
0answers
67 views

Tools for statistical analysis of binary streams

I'm in the process of decoding the semantics of an unknown binary stream1. I've come to a point where I understand the overall structure: A tag byte, followed by a size field, and a blob of bytes of ...
0
votes
0answers
35 views

Reading float value within delphi binary

I have a Delphi program that I am trying to read data from. the data is stored in a TEIDataWindow, this particular snippet of code comes from the update method. the data is presented in the form of an ...
0
votes
0answers
31 views

Missing Heap prev Size

I am currently working on a challenge and I think I have to exploit it using the House of Einherjar. I can create chunks on the heap, I can free them and I can overflow them, so everything I would ...
0
votes
0answers
100 views

How can I find loading adress of eCos firmware

From:https://www.tendacn.com/en/download/detail-3482.html Im trying to find loading address (entry point of my program) for this binary, which is part off this firmware. Im trying to load it inside ...
0
votes
0answers
47 views

IDA Fails to Analyze Stack Pointer Correctly in Heavily Chunked Functions

I am currently dealing with obfuscated code in IDA. The obfuscation I am combating is control flow obfuscation, where a function is split up into hundreds of basic blocks spread across the entire ...
0
votes
0answers
38 views

Is there a way to see 'imports' in a .NET binary?

Programs such as Detect It Easy or IDA can show functions and libraries (DLLs) imported by a binary in the case of C/C++ binaries. I have a collection of .NET malware that I'm analyzing and would like ...
0
votes
0answers
172 views

Tenda AC10 rebranded firmware Reverse egineering help

So , I'm trying to extract the firmware for the Intelbras ACtion RG1200 , but I'm unable to acess the files. The ACtion is a rebrand from the popular Tenda AC10 that I'm able to extract and edit using ...
0
votes
0answers
97 views

Radare2 jump/switch table walk for 8051

For 8051 target exist famous no-return function with body of d083d082f8e4937012740193700da3a393f8740193f5828883e4737402936860efa3a3a380df which correspond to ?C?CCASE function: / 38: fcn.00000000 ...
0
votes
1answer
55 views

What is the best approach for using IDA's remote debugger for analyzing a sample with two VMs?

Sorry if this is a stupid question but couldnt find the answer by googling Right now I analyze a malware by using remote debugger of IDA, and i run the debugger on a isolated VM that has shared a ...
0
votes
2answers
338 views

Using NAND flash dump with OOB data

I have NAND flash memory dump, as a separate MTD partitions copied from NAND flash chip use built-in nanddump commands. I need to reflash some corrupted MTD partitions. In order to reflash partitions ...
0
votes
0answers
388 views

unsquashfs failed to read SquashFS file

I tried to unpack binary which is SquashFS system, the file is mtd partition copied from NAND device, Root filesystem (read-only). Actually its SquashFS version, modifyed/patched by vendor. binwalk ...
0
votes
1answer
268 views

How to split ARM code/data from binary in Inmarsat Isatphone Pro?

I'm analyzing the 3 binaries for updating firmware to the Inmarsat Isatphone Pro phone. Additionally, I'm following the Groundworks Technologies paper, and attempting to recreate their work as a ...
0
votes
0answers
149 views

What is this function doing?

I have this function, named __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6__initEPKcm. And this is the relevant assembly: mov rdi, [rbp+var_A80] mov rsi, [rbp+var_A88] ...
0
votes
0answers
108 views

Locate compressed section of executable

I am playing with Philips DICOM Viewer - download version R3.0 SP3. This viewer can display DICOM information (press F9). Since the displayed strings are not stored in the DICOM file itself, I suspect ...
0
votes
0answers
379 views

Intercepting syscall in a shared object (dynamically linked)

Ditto. Any technique that allows to intercept sys calls issued from a shared object file? At runtime, the shared object is dlopen'ed by main(). One candidate is to use static binary rewriting (e.g. ...
0
votes
0answers
572 views

Decompress NAND dump (custom LZ77/LZSS?)

I'm trying to to reverse engineer a very old STB (it was in service between 2005 and 2014). I successfully dumped the NAND of the box but I'm struggling with the compression used. Here is an extract ...
0
votes
2answers
215 views

How to find what code created some data?

I'd like to be able to point to a buffer in memory likely on the heap and have a tool tell me which part of the binary created the data in the file. What tools can do that for me?
0
votes
0answers
116 views

Detecting and/or converting binary endianness (PPE [CELL] to Intel)

I am by no means a competent programmer in any sense of the word. I've only ever fiddled with .NET building very, very basic applications. If it's possible to be given step-by-step instructions, then ...
0
votes
1answer
2k views

Decode 96 column punch card

I don't know if this is the right place to ask, but I can't seem to find it anywhere on the internet: How do I read a 96 column IBM system/3 punch card? I am doing an exercise but I can't seem to ...
-1
votes
2answers
3k views

Decoding binary - basics [closed]

I'm trying to decode this binary file which is from a cache. All I want is the playlist metadata. I am getting some of it using a simple hex viewer, but the majority of the information is random ...
-1
votes
2answers
2k views

XOR encryption - How to find the key?

I'm trying to solve a crackme which basically uses a XOR encryption scheme in which the password is used as the key to an encrypted buffer which is subsequently executed. The following is the ...
-1
votes
1answer
2k views

How to extract D-Link DCS-4603 camera firmware

I tried extract the firmware image from the binary file available at the D-Link DCS-4603 Vigilance Full HD PoE Dome Network Camera technical support page it by using binwalk but failed. Is there ...
-1
votes
1answer
229 views

Getting the function's original file name within Ghidra

I am trying to extract the original file name of some functions through Ghidra. In particular I have enabled the debug symbols so that it does contains the function names in the disassembly listing ...
-1
votes
1answer
112 views

Understanding what is represented by function pointers to a block of hex

I'm working on a disassembly project for my class where I'm trying to bypass a license check, but when I throw the executable into Binary Ninja this is what I see: And when I look at those pointers, ...
-1
votes
1answer
476 views

Converting object file to LLVM bitcode

Frameworks like mcsema is used to convert an executable file into LLVM bitcode which can be further used to perform program analysis. Is there any way to convert an object file in the similar way?
-1
votes
1answer
459 views

Shells CTF segfault - wrong address

PicoCTF 2017 Shells I have a binary and source: #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <sys/mman.h> #define AMOUNT_OF_STUFF 10 //TODO: Ask IT ...
-1
votes
1answer
366 views

Disassembling code with Hopper

I'm trying to figure out what this code is doing. The first thing that I don't understand is the condition that tests if arg0's value is 0x2. I read that 0x2 in ASCII is STX (Start of text). Here's ...
-2
votes
2answers
6k views

Extract data from firmware (.bin) file which is compressed or encrypted

I have a firmware image of LCD TV that I want to research. Basically I want to customize RGB color settings (from source code), Logo of TV ... Is it possible? I binwalk to scan the file. binwalk ...
-3
votes
1answer
749 views

Identification of AES portion code in binary

I want to locate AES code portion in binary after reverse engineering. I have tried to locate manually and using plugin findcrypt2 but I was not successful. Kindly show me a direction so that I can ...
-3
votes
1answer
178 views

Is there always 1:1 correlation between hexadecimal and binary?

I was wondering this because I have found that some instructions, on the machine code level, are too large if taken a step down from hex to 0s and 1s. On Motorola 68000 I found that some instructions ...
-3
votes
1answer
1k views

what does VA and OEP means? and How does IAT be fixed manually? [closed]

in the context of reversing a packed binary, what does VA and OEP means? and How can IAT be fixed manually?
-4
votes
1answer
667 views

what is the best debuger for firmware router ? [closed]

down vote favorite i need debugger for firmware router ,i work in security of firmware so when i have firmware for router or other machines but i need to debug this firmware , so i need firmware ...
-5
votes
2answers
1k views

Bin file is not only storing 0s and 1s, ASCII or otherwise

Upon checking out a binary file, and according to convincing evidence, .bin file extensions are supposed to denote a file type which stores its data as 0s and 1s, or 31/32 in ASCII hex(ASCII character ...

1
5 6 7 8
9