Questions tagged [binary]

Files with machine code directly readable by the CPU or the interpreter. It encloses any executables, libraries, object code or memory dump of the analyzed software.

Filter by
Sorted by
Tagged with
24 votes
1 answer
59k views

Objdump - How to output text (eg ASCII strings) alongside assembly code?

Aim: I want to take hex and ascii data (derived from a binary file using xxd) and use Objdump (or a suitable other tool that Linux comes with) to output the memory addresses / offsets, assembly code, ...
unseen_rider's user avatar
20 votes
2 answers
36k views

Managing inputs for payload injection?

I am looking for a complete list of the ways to inject a payload in a vulnerable program in a Unix (Linux) context depending on the inputs opened by the program. I know that there are several tricks ...
perror's user avatar
  • 19.1k
18 votes
1 answer
23k views

Approach to extract useful information from binary file

The purpose of this question is to gain an understanding of the concepts behind reverse engineering and to understand what approaches may be taken to extract useful information from a binary file. I'...
Light123's user avatar
  • 195
13 votes
2 answers
10k views

What are some ways to pass raw bytes to a program via the Linux terminal?

I want to pass raw bytes to a (C) program using the Linux Bash shell. I find that when I try to pass for example "\x00\xFF\xAB", the program receiving the input actually gets the ASCII character codes ...
the_endian's user avatar
  • 1,830
13 votes
3 answers
24k views

Remove code signature from a Mac binary

How can I remove the code signature from a binary so that I can patch it without the binary refusing to run afterwards? Needless to say, I'm not the original creator of the binary, nor I have the ...
alexandernst's user avatar
13 votes
2 answers
5k views

How do the internals of a Windows update security patch work?

Wasn't sure where to ask this on stack exchange, so vote to close if you think it is in the wrong place. I am analyzing a Windows security patch. Having never examined a windows security patch, and ...
MrSynAckSter's user avatar
  • 1,256
9 votes
2 answers
10k views

How to extract functions from one executable to include/link in another

I'm wondering what are the options (aside from attempting disassembly/decompilation and reassembly/recompilation) one has when it comes to extracting a series of functions from one binary, compiled ...
Roberto Andrade's user avatar
8 votes
2 answers
14k views

OTOOL alternative for linux

I have a reverse engineering set up on a Mac machine. This set up does some reverse engineering on iOS applications(.ipa files). I'm migrating the setup from Mac to a linux machine. Currently on Mac, ...
Rohit saraf's user avatar
8 votes
1 answer
381 views

How to detect internal and shared libraries used in an executable file?

Problem: We want to be able to tell with some certainty that specific versions of internal libraries are being used by a program. For example, if a software uses old, deprecated libraries internally. ...
learnerX's user avatar
  • 233
7 votes
1 answer
4k views

Unpack IpCam firmware - Binwalk extraction issue

I'm trying to use Binwalk to extract an IpCam bin firmware. I did it successfully for the WebUI, but I can't on the firmware itself. Hardware : Vstarcam C7824WIP Firmware : CH-sys-48.53.64.67.zip ...
Ronan's user avatar
  • 73
7 votes
1 answer
346 views

Byte frequencies in different architectures' binaries?

what I'm looking for I have a binary that, for various reasons, I'm pretty sure is executable machine code (although possibly for a VM language, although I doubt it's Java). I'm looking for a table ...
Parthian Shot's user avatar
6 votes
5 answers
3k views

What is the "standard" approach to find loop in binary code?

I am working on some x86 (32/64 bits) ELF binary code. These binaries are compiled from C and C++ program code and I am trying to detect loops inside the binaries. I am newbie to this area, and I am ...
lllllllllllll's user avatar
6 votes
1 answer
1k views

How can I get the shared libraries' function calls using angr

I am trying to get all the library function calls that a binary performs in a preorder-DFT traversal of the CFG. I'm able to get the CFG like: import sys, angr import networkx as nx proj = angr....
anon's user avatar
  • 63
6 votes
1 answer
870 views

How does IPA decryption works?

All IPAs being downloaded from AppStore gets encrypted on servers as part of FairPlay DRM. But decryption is accomplished on local device. As far as I know there is some hardware module which contains ...
AseN's user avatar
  • 161
5 votes
4 answers
2k views

Why are PUSHF and POPF so slow?

the experiment is on 32-bit x86 Linux. I am doing some static binary instrumentation work, and basically I am trying to insert some instructions below to the beginning of every basic block. BB23 : ...
lllllllllllll's user avatar
5 votes
2 answers
266 views

What's the best way of improving already compiled binary?

Like if I want to patch a function in a PE. Now my way of doing this would be inserting a new section using lets say LordPE and then compiling anything I want to add up here and patching the original ...
rec's user avatar
  • 475
5 votes
0 answers
3k views

Can IDA generate C code for ASM assembly without the binary?

Lets say I have this picture of some assembly: Now I know how to manual tranform this assembly into C code because it is small but is it possible for IDA to convert this into C code? Ideally I would ...
Mo Beigi's user avatar
  • 151
4 votes
1 answer
3k views

How to find the size of an array in binary?

I'm currently learning RE and try to understand some basic c programs. I've almost figure out some concepts, but right now i've no idea how to find the size of an array when i use objdump or gdb. ...
MrHawy's user avatar
  • 143
4 votes
2 answers
324 views

What are the popular machine learning unsupervised approaches to learning binary data representations?

This is somewhat open-ended question, so bear with me please. Be it a binary payload that you pull from network packet, firmware blob you pull of some EPROM or data intercepted straight from physical ...
Tomas Pruzina's user avatar
4 votes
1 answer
933 views

Radare2 ptrace can not attach

First my setup: Linux Mint 64bit 4.15.0-20-generic radare2 the newest version from github /etc/sysctl.d/10-ptrace.conf = 0 Executable: ELF 64-bit LSB executable, x86-64 read write and ...
Michael Santos's user avatar
4 votes
1 answer
3k views

Lipo alternate for linux

Currently, I'm using lipo tool to extract the arch type from a fat iOS binary on a Mac OS. Now, I want to do the same on the linux platform for the iOS binaries, i.e. extract a given arch type from a ...
Rohit saraf's user avatar
4 votes
1 answer
3k views

Extract a secret from an Android apk or .so file

Context As an exercise I am researching all methods of hiding a secret in an android mobile app binary... Yes I know that with more or less effort they can always be extracted with static analyses, ...
Exadra37's user avatar
  • 141
4 votes
1 answer
995 views

Unpacking a Digi Connect ME bin file

I'm working with a Digi Connect ME serial to Ethernet bridge, which runs a "Plug and Play" firmware by default. The specific product page is here. The part number is DC-ME-01T-S. It appears to be an ...
Cybergibbons's user avatar
  • 1,762
4 votes
1 answer
3k views

How to extract DVB firmware bin file?

I have a bin file of DVB (DTH) box firmware. I want to change one image inside that bin file, how I can do this? Please guide me in right direction. I tried bin walk, but the file that it extracted ...
Varun Naharia's user avatar
4 votes
1 answer
344 views

How to find the index of static ilbrary functions in the PLT of the binary?

So right now I'm trying to resolve function calls and their names in my reversing tool the problem I'm having is that library functions such as printf and fwrite and such do not have a corresponding ...
Max's user avatar
  • 99
4 votes
0 answers
93 views

Any way to edit an ELF binary without hex? [duplicate]

So, this is a noob question, I am a complete beginner in this field, so sorry if I'm wasting your time in any way. I wanted to know, if there is a way to edit an ELF binary without using a hex editor....
InxaneNinja's user avatar
3 votes
1 answer
745 views

Computing subtracted stack space for a function manually

Lets assume this function frame : How to calculate and check if subtracted stack space by line 3 is 58h ?: sub esp, 58h And this is the code, the compiler is also Dev C++: #include <stdio.h> ...
Vlad's user avatar
  • 139
3 votes
1 answer
2k views

Date and time data extraction from a hex dump

I am trying to retrieve date and time data from a hex dump. I found following entries that has entry id and date time information in it. But, I am not sure about which offset it is. 60 03 00 00 00 F1 ...
Shakil's user avatar
  • 131
3 votes
2 answers
1k views

Translating a Korean Exclusive PS2 game ~ hangeul encoding?

I got my hands on a copy of Mystic Nights, a survival horror game for the PS2 realeased exclusively in Korea. The game's text is all in Hangeul (Korean writting system). I extracted the ISO and ...
Shpack's user avatar
  • 43
3 votes
1 answer
5k views

Decode C# binary serialization data

I am trying to decode what seems to be simple C# binary serialization to disk: https://github.com/malaterre/MMCPrivate/raw/master/sample1.raw https://github.com/malaterre/MMCPrivate/raw/master/...
tibar's user avatar
  • 375
3 votes
1 answer
205 views

Debug point not hit with radare2

I am doing this reverse engenering challenge. I executed theses commands to analyse the main function : radare2.exe ch15.exe aaa s main pdf This is the output of the pdf command : [0x004017b8]> ...
Anonymous's user avatar
  • 221
3 votes
1 answer
1k views

Colorize and disassemble byte sequences with IDA Pro and IDAPython

Maybe someone could help me with the following problem: I have an interesting byte sequence that I found within a MIPS ELF binary that exists on the hard drive. This byte sequence may be, for example,...
metaphysicalmarty's user avatar
3 votes
2 answers
780 views

Ways to define portable executable bitness 64 vs 32

I found several ways to define the bitness of PE. IMAGE_FILE_HEADER contains the/a (how do you choose an article type in such place?) field Characteristics that could be checked for ...
SerG's user avatar
  • 131
3 votes
1 answer
91 views

Reverse engineer a blackbox function operating on single or double precision floats for emulation

I own and run a NEC VectorEngine 10C which is a PCIe accelerator running a proprietary ISA which has many fun instructions among them is VRSQRT which computes an approximation of the inverse ...
worldsmithhelper's user avatar
3 votes
1 answer
210 views

Unusual datetime format

I am looking at the registry keys created for three programs from a now defunct company, one of which is trial software. One entry of interest is the REG_BINARY key InstallTime. I have an idea of what ...
DoomTay's user avatar
  • 153
3 votes
1 answer
524 views

What is data only exploitation?

I was wondering, and after trying to read for the past several months I got totally lost and don't understand this concept. Could someone please explain in simple words the concept of data only ...
one1one's user avatar
  • 31
3 votes
2 answers
622 views

Track execution of bytes in a Linux executable

Given a binary executable file (in this case, a compiled C file which finds the gcd of 2 numbers), is there a tool which profiles the execution of this file and could generate some sort of call graph ...
Revenant013's user avatar
3 votes
1 answer
2k views

Modifying a string in a .net binary

I have a .net exe called foo.exe I open foo in a hex editor (HxD) and search for myString. I do not see it. I open foo.exe in ILSpy and was able to find myString. I do see human readable text in the ...
user20610's user avatar
3 votes
1 answer
1k views

Advanced Binary Exploitation CTF

I wanted to ask your assistance: Where can I find advanced ctfs (that hopefully contain solutions) regarding binary/kernel exploitation? I am interested on finding x86_64 linux/windows/arm64 that ...
BegiNO's user avatar
  • 56
3 votes
0 answers
625 views

Disassembly of raw binary of AARCH64 using Ghidra not complete

I am trying to disassemble a raw binary with AARCH64:LE:64:v8A​:default (as per below mentioned specs). Architecture: aarch64 CPU op-mode(s): 32-bit, 64-bit Byte Order: Little Endian CPU(s): 8 On-...
sharma21's user avatar
3 votes
0 answers
131 views

Trying to understand a simple compiled PSI binary file

I was working with an old ios game, and found that it saved most of its data (players, worlds, anything in-between) in MDB files.. titled data.mdb and lock.mdb. There is a pair for every object type (...
Mister SirCode's user avatar
3 votes
0 answers
2k views

Analysing eCos image

I'm working on unpacking a firmware image. I've already uncompressed the original image, but I'm stuck in the current step. This is the current uncompressed image: https://www.dropbox.com/s/...
tnas's user avatar
  • 31
2 votes
3 answers
1k views

Good Binary Vulnerability Research Resources [closed]

I have spent the past several months refreshing my knowledge of x86 and updating to understand x64, and going through binary exploit development courses. Now that I am equipped with the necessary ...
user4217's user avatar
2 votes
1 answer
818 views

Windows boot process doesn't make sense!

Here is my question: How can the Windows 7, 8, etc. boot process work? The first piece of code loaded from the volume boot sector of the OS is bootmgr.exe. But here's why this doesn't make sense: An ...
Some girls R ignorant's user avatar
2 votes
3 answers
949 views

Is the main function's name in the symbol table of C & C++ programs always 'main'? if not, how to find the name?

So I'm trying to write a reversing tool that parses symbol table to find the main function's address right now all the binaries I'm checking the name of main function is still main in symbol table ...
Max's user avatar
  • 99
2 votes
2 answers
1k views

Wrong RVA values inside IMAGE_IMPORT_DESCRIPTOR

I load the entire PE into an std::vector<Byte> fileContent using std::fstream. Then I obtain the executable's dos header: IMAGE_DOS_HEADER* imageDosHeader = (IMAGE_DOS_HEADER*)fileContent.data(...
anx199's user avatar
  • 175
2 votes
2 answers
171 views

reading data from a binary file

000000 00 00 00 00 00 00 00 00 00 00 00 00 01 01 08 03 000010 17 10 15 27 00 00 01 00 FB 00 0A 00 00 00 38 FF 000020 01 00 FB 00 09 00 00 00 34 FF 01 00 FB 00 09 00 000030 00 00 31 FF 01 00 FB 00 08 ...
Nezam's user avatar
  • 51
2 votes
1 answer
458 views

obtaining string value from Unknown elf-x86-64 binary with gdb

I'm trying to find a string value stored in memory by a binary (possibly written in C) that won't show up when I perform "strings a.out". I have tried examining particular memory addresses of interest ...
To Ban's user avatar
  • 21
2 votes
3 answers
3k views

legitimate memory pages that are marked as RWX?

In windows and linux x86 (including x86_64) world, is there any legitimate binary (i.e., a program binary generated by the typical compiling-assembling-linking flow and no manual editing on binary ...
drdot's user avatar
  • 279
2 votes
1 answer
967 views

In angr, how to Load and Analyze a binary file that only contain a function instructions

I have some binary files, each of them contain instructions of a function, (may be a little more in the end). The begining of the file also is the start point of the function. This files were ...
Swing's user avatar
  • 121