Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [binary]

Files with machine code directly readable by the CPU or the interpreter. It encloses any executables, libraries, object code or memory dump of the analyzed software.

0
votes
1answer
1k views

.bin files Firmware

I'm looking for help in analyzing a few .bin files. I have a program that installs a "firmware" update when I connect my camera through USB. I'm on a Mac Os Sierra. Inside the Applications Folder ...
0
votes
1answer
692 views

Adding section to PE binary using Stud_Pe

I want to be able to accurately add a section to a binary by hand, without tools. I am using Stud_Pe for adding a section to a binary. While this work, I feel it's important to be able to do this ...
5
votes
1answer
5k views

Managing inputs for payload injection?

I am looking for a complete list of the ways to inject a payload in a vulnerable program in a Unix (Linux) context depending on the inputs opened by the program. I know that there are several tricks ...
0
votes
1answer
94 views

how Can I use a linux so file from a program other than the program it was developed for?

I wish to use the codecs that come with realplayer but without needing realplayer. The codecs I want to use are all in .so format, but I don't know how to separate the codecs from the rest of ...
5
votes
1answer
4k views

Remove code signature from a Mac binary

How can I remove the code signature from a binary so that I can patch it without the binary refusing to run afterwards? Needless to say, I'm not the original creator of the binary, nor I have the ...
0
votes
2answers
371 views

How to download Linksys firmware from router

A co-worker gave me his mom's Linksys router that he is convinced has been hacked to include a MitM. We could just upgrade the firmware, but that wouldn't be any fun and so I thought this might be a ...
2
votes
1answer
6k views

Extracting firmware BIN file

I'm trying to extract this firmware to check whats inside, but can't find how to tackle this file. I was only able to extract and read PNG image. Binwalk scan: DECIMAL HEX DESCRIPTION ---...
2
votes
1answer
1k views

Firmware-mod-kit says “No supported filesystem” along with strange and long output

I tried firmware-mod-kit's extract-firmware.sh script and I receive the following output which ends with "No supported filesystem found". The firmware belongs to the TL-WR740Nv5 router. The ...
1
vote
0answers
746 views

Modification of existing binary firmware update

I have several IP cameras from china, and I need to add some software to it. I have to ways how to burn my software into camera ROM using hardware programmer and using special binary what I upload ...
8
votes
1answer
280 views

Byte frequencies in different architectures' binaries?

what I'm looking for I have a binary that, for various reasons, I'm pretty sure is executable machine code (although possibly for a VM language, although I doubt it's Java). I'm looking for a table ...
1
vote
1answer
499 views

What are the side effects of setting the timestamp in the PE-header to 0?

The PE-Header of Windows executables contains as its third field the "Timestamp at compile time". To reach reproducibility in our build process we would like to set the time (Epoch seconds) to zero (=...
7
votes
4answers
2k views

What is the “standard” approach to find loop in binary code?

I am working on some x86 (32/64 bits) ELF binary code. These binaries are compiled from C and C++ program code and I am trying to detect loops inside the binaries. I am newbie to this area, and I am ...
2
votes
1answer
583 views

Given a program binary, how can I know which compiler it is compiled from?

Basically I have a set of 32-bit ELF program binaries compiled by either gcc or llvm. They are all stripped before analysis. My question is that, given a binary, is there any way I can determine ...
7
votes
1answer
3k views

Unpack IpCam firmware - Binwalk extraction issue

I'm trying to use Binwalk to extract an IpCam bin firmware. I did it successfully for the WebUI, but I can't on the firmware itself. Hardware : Vstarcam C7824WIP Firmware : CH-sys-48.53.64.67.zip ...
3
votes
0answers
805 views

Analysing eCos image

I'm working on unpacking a firmware image. I've already uncompressed the original image, but I'm stuck in the current step. This is the current uncompressed image: https://www.dropbox.com/s/...
3
votes
1answer
884 views

Colorize and disassemble byte sequences with IDA Pro and IDAPython

Maybe someone could help me with the following problem: I have an interesting byte sequence that I found within a MIPS ELF binary that exists on the hard drive. This byte sequence may be, for example,...
2
votes
0answers
2k views

Can IDA generate C code for ASM assembly wihtout the binary

Lets say I have this picture of some assembly: Now I know how to manual tranform this assembly into C code because it is small but is it possible for IDA to convert this into C code? Ideally I would ...
1
vote
1answer
281 views

Variable liveness analysis on binaries

I want to detect all the variables live at any instruction/address in a binary. By variable, I refer to both global as well as function local variables. In other words, given a Linux ELF and a virtual ...
1
vote
2answers
714 views

Assembly - Binary Bomb Confusion

I have an assignment for reverse engineering a binary. The function I'm up to takes a string input and reads one character at a time. It is as follows (push/pop registers removed): 8048b6e: mov $...
2
votes
1answer
753 views

Does Windows 7 Pro use ASLR for win32 executable?

I unpacked a UPX packed PE binary. Both the packed and unpacked binary have fixed image base of 0x400000 (Checked by various PE tools). However, every time I run the program in OllyDbg, the image ...
2
votes
1answer
1k views

Anti reverse engineering tools that are easy to set up

I will be distributing a c++ application, and I was wondering if there was any tools available to add an extra layer of security against reverse engineering. I'm looking for a quick fix because I don'...
1
vote
3answers
773 views

RE'ing a Binary

I have a laptop that I recently lost the BIOS Admin password for. I contacted the manufacturer and, after giving them some information about my BIOS (version, uuid), they sent me a file, smc.bin to ...
4
votes
4answers
973 views

Why are PUSHF and POPF so slow?

the experiment is on 32-bit x86 Linux. I am doing some static binary instrumentation work, and basically I am trying to insert some instructions below to the beginning of every basic block. BB23 : ...
3
votes
1answer
446 views

Computing subtracted stack space for a function manually

Lets assume this function frame : How to calculate and check if subtracted stack space by line 3 is 58h ?: sub esp, 58h And this is the code, the compiler is also Dev C++: #include <stdio.h> ...
-1
votes
2answers
489 views

Decoding binary - basics [closed]

I'm trying to decode this binary file which is from a cache. All I want is the playlist metadata. I am getting some of it using a simple hex viewer, but the majority of the information is random ...
3
votes
2answers
453 views

Ways to define portable executable bitness 64 vs 32

I found several ways to define the bitness of PE. IMAGE_FILE_HEADER contains the/a (how do you choose an article type in such place?) field Characteristics that could be checked for ...
8
votes
2answers
7k views

How to extract functions from one executable to include/link in another

I'm wondering what are the options (aside from attempting disassembly/decompilation and reassembly/recompilation) one has when it comes to extracting a series of functions from one binary, compiled ...
3
votes
1answer
2k views

How to find the size of an array in binary?

I'm currently learning RE and try to understand some basic c programs. I've almost figure out some concepts, but right now i've no idea how to find the size of an array when i use objdump or gdb. ...
1
vote
1answer
323 views

How do I find non-exported symbols of a binary?

You can use nm(liux/mac) to find exported and imported functions/symbols, is it possible to find the non-exported symbols of a binary in a similar way? Are there command line tools to assist with this?...
0
votes
1answer
512 views

Help editing assembly with IDA [duplicate]

I have the line: mov [esp+var], ebp and want to change it to: mov [esp+var], ebp+20 To my understanding, Edit>Patch Program>Change Byte, is what should be used.. but I know very little on to what ...
2
votes
1answer
549 views

Windows boot process doesn't make sense!

Here is my question: How can the Windows 7, 8, etc. boot process work? The first piece of code loaded from the volume boot sector of the OS is bootmgr.exe. But here's why this doesn't make sense: An ...
10
votes
1answer
3k views

How do the internals of a Windows update security patch work?

Wasn't sure where to ask this on stack exchange, so vote to close if you think it is in the wrong place. I am analyzing a Windows security patch. Having never examined a windows security patch, and ...
2
votes
1answer
1k views

How are dylib files laid out

My end goal here is to find the Mach-O header in a dylib file. Here's what I've come up with so far: All my dylib files have the following first four bytes: 0xcafebabe. Then after 4096 bytes the ...
3
votes
1answer
732 views

Date and time data extraction from a hex dump

I am trying to retrieve date and time data from a hex dump. I found following entries that has entry id and date time information in it. But, I am not sure about which offset it is. 60 03 00 00 00 F1 ...
-1
votes
3answers
139 views

Any programs that can convert textual ones and zeroes to full comparison bytes?

since the byte is the lowest addressable datum and bit rotating/flipping can come in to play here, are there any programs that can enable you to write ones and zeroes (binary), and after every 8 of ...
4
votes
1answer
761 views

Unpacking a Digi Connect ME bin file

I'm working with a Digi Connect ME serial to Ethernet bridge, which runs a "Plug and Play" firmware by default. The specific product page is here. The part number is DC-ME-01T-S. It appears to be an ...