Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [binary]

Files with machine code directly readable by the CPU or the interpreter. It encloses any executables, libraries, object code or memory dump of the analyzed software.

1
vote
3answers
84 views

Is the main function's name in the symbol table of C & C++ programs always 'main'? if not, how to find the name?

So I'm trying to write a reversing tool that parses symbol table to find the main function's address right now all the binaries I'm checking the name of main function is still main in symbol table ...
0
votes
1answer
70 views

ISO8859-1 serialization for strings

I am currently investigating a weird layout for storing of what appears to be strings (medical format). Looking at the dump for a bunch of those strings here is what I see: $ hexdump -C out0000 ...
1
vote
0answers
33 views

How to find the index of static ilbrary functions in the PLT of the binary?

So right now I'm trying to resolve function calls and their names in my reversing tool the problem I'm having is that library functions such as printf and fwrite and such do not have a corresponding ...
0
votes
2answers
51 views

Decode C# binary serialization data

I am trying to decode what seems to be simple C# binary serialization to disk: https://github.com/malaterre/MMCPrivate/raw/master/sample1.raw https://github.com/malaterre/MMCPrivate/raw/master/...
0
votes
1answer
51 views

What type of function gets called using a register instead of address in the binary? how to find the address statically?

So I'm trying to write a reversing tool right now and trying to make a CALL graph the problem I'm having is some calls are like Call *eax instead Call 'address' I can easily generate the call-graph ...
0
votes
0answers
44 views

Edit unknown binary file

I have here an unknown binary file which contains a graphical user interface. The file has the ending .kzb and it comes from the Kanzi desinger. Unfortunately the Kanzi desinger can no longer edit the ...
0
votes
1answer
40 views

Best python framework/library for constructing the call-graph from binary?

So i have written a python tool using capstone that disassembles the code section of a ELF binary using capstone. now i want to also create and show the call-graph of this binary in a dot format, I ...
1
vote
1answer
57 views

Lipo alternate for linux

Currently, I'm using lipo tool to extract the arch type from a fat iOS binary on a Mac OS. Now, I want to do the same on the linux platform for the iOS binaries, i.e. extract a given arch type from a ...
1
vote
0answers
32 views

How do I decode arbitrary data from a raw extracted binary?

I have a IoT scale that stores my measurements into records and passes them onto my phone. I was able to read directly off a flash chip and create a binary file. The chipset is ARMv7. I want to be ...
0
votes
0answers
44 views

Any way to edit an ELF binary without hex? [duplicate]

So, this is a noob question, I am a complete beginner in this field, so sorry if I'm wasting your time in any way. I wanted to know, if there is a way to edit an ELF binary without using a hex editor....
0
votes
0answers
46 views

Vulnerabilities of Binary executed by root

I was given a vulnerable 64bit dynamically linked stripped that runs simple checks to determine the strength of the passwords of users on a linux system. The app checks if it the EUID is 0 and then ...
5
votes
1answer
5k views

Managing inputs for payload injection?

I am looking for a complete list of the ways to inject a payload in a vulnerable program in a Unix (Linux) context depending on the inputs opened by the program. I know that there are several tricks ...
1
vote
0answers
210 views

OTOOL alternative for linux

I have a reverse engineering set up on a Mac machine. This set up does some reverse engineering on iOS applications(.ipa files). I'm migrating the setup from Mac to a linux machine. Currently on Mac, ...
2
votes
1answer
210 views

Extract a secret from an Android apk or .so file

Context As an exercise I am researching all methods of hiding a secret in an android mobile app binary... Yes I know that with more or less effort they can always be extracted with static analyses, ...
0
votes
0answers
36 views

Will an iOS app (IPA) that requires a login work if I repack it and install it on the device?

I downloaded iOS WhatsApp from App Store, decrypted the binary, repacked it, and installed it back onto the device (deleting the app before installing). When I opened it, it only showed me a blank ...
1
vote
1answer
200 views

How to reverse engineer a Black Box?

I am trying to reverse engineer / research a black box system, this is, a system for which there is no public information at all. Let's say the system is a modern handheld console. I have already ...
0
votes
1answer
67 views

rip adress not visible with dr command

I just finished this challenge. This is the content of main function : [0x08048a86]> pdf / (fcn) main 417 | main (int argc, char **argv, char **envp); | ; var int local_16h @ ebp-0x16 |...
2
votes
1answer
65 views

Debug point not hit with radare2

I am doing this reverse engenering challenge. I executed theses commands to analyse the main function : radare2.exe ch15.exe aaa s main pdf This is the output of the pdf command : [0x004017b8]> ...
7
votes
1answer
163 views

How to detect internal and shared libraries used in an executable file?

Problem: We want to be able to tell with some certainty that specific versions of internal libraries are being used by a program. For example, if a software uses old, deprecated libraries internally. ...
2
votes
1answer
45 views

obtaining string value from Unknown elf-x86-64 binary with gdb

I'm trying to find a string value stored in memory by a binary (possibly written in C) that won't show up when I perform "strings a.out". I have tried examining particular memory addresses of interest ...
0
votes
1answer
1k views

.bin files Firmware

I'm looking for help in analyzing a few .bin files. I have a program that installs a "firmware" update when I connect my camera through USB. I'm on a Mac Os Sierra. Inside the Applications Folder ...
2
votes
1answer
455 views

Modifying a string in a .net binary

I have a .net exe called foo.exe I open foo in a hex editor (HxD) and search for myString. I do not see it. I open foo.exe in ILSpy and was able to find myString. I do see human readable text in the ...
2
votes
2answers
203 views

Wrong RVA values inside IMAGE_IMPORT_DESCRIPTOR

I load the entire PE into an std::vector<Byte> fileContent using std::fstream. Then I obtain the executable's dos header: IMAGE_DOS_HEADER* imageDosHeader = (IMAGE_DOS_HEADER*)fileContent.data(...
1
vote
1answer
460 views

*.abs (sfw) emulation in Qemu - MIPS (abs = Amiko,Skybox,OpenBox, Cryptobox,… file firmware)

I have some questions well today I tried to emulate with (Qemu) a STB firmware (.abs extension file) in Qemu. So I tried to unpack the .abs file I got many files. Example for: Amiko HD8150 2.4.43 emu ...
12
votes
1answer
11k views

Approach to extract useful information from binary file

The purpose of this question is to gain an understanding of the concepts behind reverse engineering and to understand what approaches may be taken to extract useful information from a binary file. I'...
1
vote
0answers
69 views

Is Dynamic Binary Instrumentation legal in UK/EU for malware analysis?

I am doing a university project about performing malware analysis on binary files. The end goal would be to analyze real world executables(Microsoft Office installation file for example). If I use DBI,...
1
vote
1answer
134 views

My Shellcode is in a non-executable part of a Windows executable. Is there still a way to execute it?

I'm trying to exploit a test server executable that holds some user-controlled data in memory. I can gain control of EIP and go there, however I get an access violation in OllyDBG because it's not ...
0
votes
1answer
110 views

Newbie here: hidden values in assembly? [closed]

So i'm new to the whole reverse engineering thing with only experience in C#. So I wanted to try and change the framerate of applications (eg. this unity game) at an assembly level on iOS ( I have an ...
3
votes
1answer
105 views

What are the popular machine learning unsupervised approaches to learning binary data representations?

This is somewhat open-ended question, so bear with me please. Be it a binary payload that you pull from network packet, firmware blob you pull of some EPROM or data intercepted straight from physical ...
0
votes
1answer
102 views

Reverse engineering checksum - LG 485 a/c protocol

I'm trying to reverse engineer serial protocol, everything seems straightforward, except checksum byte. Seems to be some easy algorithm - when sum of all bytes is the same, checksum/crc stays the same....
1
vote
1answer
321 views

Binary encryption

I'd like to ask your help to understand the algorithm used to encrypt these hex/bin firmware (for an ARM-Cortex M4 microcontroller). In the tar file above you can find different firmware versions. ...
2
votes
2answers
194 views

Track execution of bytes in a Linux executable

Given a binary executable file (in this case, a compiled C file which finds the gcd of 2 numbers), is there a tool which profiles the execution of this file and could generate some sort of call graph ...
1
vote
1answer
264 views

How to change a string in a arm 32bit lsb executable binary using radare2?

I have a arm 32bit lsb executable which prints "hello world" to the screen. How do I change the string to "Good bye" using radare2. I believe this will teach me the basics of RE and radare2. Thank ...
0
votes
2answers
760 views

How can i start the RE process in radare2?(make changes to the registers) [closed]

I'm an absolute newbie to reverse engineering. I have a 32bit lsb arm binary which I would like to reverse engineer using radare2. How should I begin ?
1
vote
1answer
43 views

Assuming you know everything about a hardware platform, can you reverse the BLOB that is required for its operation? [closed]

I do not understand, if you know everything there is to be known about your hardware, can't you work your way up and find out what the binary does exactly?
11
votes
1answer
21k views

Objdump - How to output text (eg ASCII strings) alongside assembly code?

Aim: I want to take hex and ascii data (derived from a binary file using xxd) and use Objdump (or a suitable other tool that Linux comes with) to output the memory addresses / offsets, assembly code, ...
1
vote
1answer
108 views

How to check proprietary firmware for GPL violation

I have a proprietary binary (firmware), and I'd like to check whether it contains opensource components. I'm thinking about extracting what it contains - probably binaries - and use strings, grep and ...
1
vote
1answer
720 views

Trying to identify a string in a strcmp instruction

Working to debug and analyze a piece of firmware, I've come across a bunch of cgi files which are all symlinked to a central cgi file. The first thing the main function does is run a series of string ...
3
votes
1answer
204 views

Debugging Binary using Far Ret to switch Code Segment

It appears that GDB is unable to handle binaries which switch code segments. Using pwntools*, it's trivial to generate a 32-bit intel binary which uses retf to switch to the 64-bit code segment. ...
5
votes
1answer
4k views

Remove code signature from a Mac binary

How can I remove the code signature from a binary so that I can patch it without the binary refusing to run afterwards? Needless to say, I'm not the original creator of the binary, nor I have the ...
1
vote
1answer
279 views

In angr, how to Load and Analyze a binary file that only contain a function instructions

I have some binary files, each of them contain instructions of a function, (may be a little more in the end). The begining of the file also is the start point of the function. This files were ...
5
votes
1answer
341 views

How can I get the shared libraries' function calls using angr

I am trying to get all the library function calls that a binary performs in a preorder-DFT traversal of the CFG. I'm able to get the CFG like: import sys, angr import networkx as nx proj = angr....
0
votes
1answer
63 views

How to find out where an application stores the resolutions it allows?

Many applications (in particular most games) offer a set of resolutions to choose from. Some of them are pretty open and allow basically every resolution the underlying system seems to be capable of, ...
5
votes
2answers
168 views

What's the best way of improving already compiled binary?

Like if I want to patch a function in a PE. Now my way of doing this would be inserting a new section using lets say LordPE and then compiling anything I want to add up here and patching the original ...
1
vote
1answer
119 views

Is it possible to make a string bigger on an executable without breaking it?

I am a new reverse enigneerer. I know I can patch strings using a hex editor, but I obviously can't add or remove a single byte. Is there any workaround that will let me make a... let's say, 10 byte ...
1
vote
1answer
332 views

How to find Xref to strings in proprietary binaries?

When I try to disassemble proprietary ARM binaries (no symbol), like Android phone's boot loaders, I find there are a bunch of strings that do not have any "Xrefs to" in IDA Pro. The image has ...
3
votes
3answers
680 views

legitimate memory pages that are marked as RWX?

In windows and linux x86 (including x86_64) world, is there any legitimate binary (i.e., a program binary generated by the typical compiling-assembling-linking flow and no manual editing on binary ...
3
votes
0answers
805 views

Analysing eCos image

I'm working on unpacking a firmware image. I've already uncompressed the original image, but I'm stuck in the current step. This is the current uncompressed image: https://www.dropbox.com/s/...
0
votes
1answer
94 views

how Can I use a linux so file from a program other than the program it was developed for?

I wish to use the codecs that come with realplayer but without needing realplayer. The codecs I want to use are all in .so format, but I don't know how to separate the codecs from the rest of ...
2
votes
1answer
1k views

Firmware-mod-kit says “No supported filesystem” along with strange and long output

I tried firmware-mod-kit's extract-firmware.sh script and I receive the following output which ends with "No supported filesystem found". The firmware belongs to the TL-WR740Nv5 router. The ...