Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [binary]

Files with machine code directly readable by the CPU or the interpreter. It encloses any executables, libraries, object code or memory dump of the analyzed software.

11
votes
1answer
10k views

Approach to extract useful information from binary file

The purpose of this question is to gain an understanding of the concepts behind reverse engineering and to understand what approaches may be taken to extract useful information from a binary file. I'...
11
votes
1answer
18k views

Objdump - How to output text (eg ASCII strings) alongside assembly code?

Aim: I want to take hex and ascii data (derived from a binary file using xxd) and use Objdump (or a suitable other tool that Linux comes with) to output the memory addresses / offsets, assembly code, ...
10
votes
1answer
3k views

How do the internals of a Windows update security patch work?

Wasn't sure where to ask this on stack exchange, so vote to close if you think it is in the wrong place. I am analyzing a Windows security patch. Having never examined a windows security patch, and ...
8
votes
2answers
6k views

How to extract functions from one executable to include/link in another

I'm wondering what are the options (aside from attempting disassembly/decompilation and reassembly/recompilation) one has when it comes to extracting a series of functions from one binary, compiled ...
8
votes
1answer
276 views

Byte frequencies in different architectures' binaries?

what I'm looking for I have a binary that, for various reasons, I'm pretty sure is executable machine code (although possibly for a VM language, although I doubt it's Java). I'm looking for a table ...
7
votes
4answers
1k views

What is the “standard” approach to find loop in binary code?

I am working on some x86 (32/64 bits) ELF binary code. These binaries are compiled from C and C++ program code and I am trying to detect loops inside the binaries. I am newbie to this area, and I am ...
7
votes
1answer
154 views

How to detect internal and shared libraries used in an executable file?

Problem: We want to be able to tell with some certainty that specific versions of internal libraries are being used by a program. For example, if a software uses old, deprecated libraries internally. ...
6
votes
1answer
2k views

Unpack IpCam firmware - Binwalk extraction issue

I'm trying to use Binwalk to extract an IpCam bin firmware. I did it successfully for the WebUI, but I can't on the firmware itself. Hardware : Vstarcam C7824WIP Firmware : CH-sys-48.53.64.67.zip ...
5
votes
1answer
307 views

How can I get the shared libraries' function calls using angr

I am trying to get all the library function calls that a binary performs in a preorder-DFT traversal of the CFG. I'm able to get the CFG like: import sys, angr import networkx as nx proj = angr....
4
votes
4answers
935 views

Why are PUSHF and POPF so slow?

the experiment is on 32-bit x86 Linux. I am doing some static binary instrumentation work, and basically I am trying to insert some instructions below to the beginning of every basic block. BB23 : ...
4
votes
2answers
163 views

What's the best way of improving already compiled binary?

Like if I want to patch a function in a PE. Now my way of doing this would be inserting a new section using lets say LordPE and then compiling anything I want to add up here and patching the original ...
4
votes
1answer
736 views

Unpacking a Digi Connect ME bin file

I'm working with a Digi Connect ME serial to Ethernet bridge, which runs a "Plug and Play" firmware by default. The specific product page is here. The part number is DC-ME-01T-S. It appears to be an ...
3
votes
1answer
4k views

Managing inputs for payload injection?

I am looking for a complete list of the ways to inject a payload in a vulnerable program in a Unix (Linux) context depending on the inputs opened by the program. I know that there are several tricks ...
3
votes
1answer
4k views

Remove code signature from a Mac binary

How can I remove the code signature from a binary so that I can patch it without the binary refusing to run afterwards? Needless to say, I'm not the original creator of the binary, nor I have the ...
3
votes
1answer
413 views

Computing subtracted stack space for a function manually

Lets assume this function frame : How to calculate and check if subtracted stack space by line 3 is 58h ?: sub esp, 58h And this is the code, the compiler is also Dev C++: #include <stdio.h> ...
3
votes
1answer
2k views

How to find the size of an array in binary?

I'm currently learning RE and try to understand some basic c programs. I've almost figure out some concepts, but right now i've no idea how to find the size of an array when i use objdump or gdb. ...
3
votes
1answer
715 views

Date and time data extraction from a hex dump

I am trying to retrieve date and time data from a hex dump. I found following entries that has entry id and date time information in it. But, I am not sure about which offset it is. 60 03 00 00 00 F1 ...
3
votes
1answer
102 views

What are the popular machine learning unsupervised approaches to learning binary data representations?

This is somewhat open-ended question, so bear with me please. Be it a binary payload that you pull from network packet, firmware blob you pull of some EPROM or data intercepted straight from physical ...
3
votes
1answer
871 views

Colorize and disassemble byte sequences with IDA Pro and IDAPython

Maybe someone could help me with the following problem: I have an interesting byte sequence that I found within a MIPS ELF binary that exists on the hard drive. This byte sequence may be, for example,...
3
votes
2answers
441 views

Ways to define portable executable bitness 64 vs 32

I found several ways to define the bitness of PE. IMAGE_FILE_HEADER contains the/a (how do you choose an article type in such place?) field Characteristics that could be checked for ...
3
votes
0answers
756 views

Analysing eCos image

I'm working on unpacking a firmware image. I've already uncompressed the original image, but I'm stuck in the current step. This is the current uncompressed image: https://www.dropbox.com/s/...
2
votes
1answer
539 views

Windows boot process doesn't make sense!

Here is my question: How can the Windows 7, 8, etc. boot process work? The first piece of code loaded from the volume boot sector of the OS is bootmgr.exe. But here's why this doesn't make sense: An ...
2
votes
2answers
123 views

Wrong RVA values inside IMAGE_IMPORT_DESCRIPTOR

I load the entire PE into an std::vector<Byte> fileContent using std::fstream. Then I obtain the executable's dos header: IMAGE_DOS_HEADER* imageDosHeader = (IMAGE_DOS_HEADER*)fileContent.data(...
2
votes
3answers
620 views

legitimate memory pages that are marked as RWX?

In windows and linux x86 (including x86_64) world, is there any legitimate binary (i.e., a program binary generated by the typical compiling-assembling-linking flow and no manual editing on binary ...
2
votes
1answer
6k views

Extracting firmware BIN file

I'm trying to extract this firmware to check whats inside, but can't find how to tackle this file. I was only able to extract and read PNG image. Binwalk scan: DECIMAL HEX DESCRIPTION ---...
2
votes
1answer
1k views

How are dylib files laid out

My end goal here is to find the Mach-O header in a dylib file. Here's what I've come up with so far: All my dylib files have the following first four bytes: 0xcafebabe. Then after 4096 bytes the ...
2
votes
1answer
63 views

Extract a secret from an Android apk or .so file

Context As an exercise I am researching all methods of hiding a secret in an android mobile app binary... Yes I know that with more or less effort they can always be extracted with static analyses, ...
2
votes
1answer
55 views

Debug point not hit with radare2

I am doing this reverse engenering challenge. I executed theses commands to analyse the main function : radare2.exe ch15.exe aaa s main pdf This is the output of the pdf command : [0x004017b8]> ...
2
votes
1answer
33 views

obtaining string value from Unknown elf-x86-64 binary with gdb

I'm trying to find a string value stored in memory by a binary (possibly written in C) that won't show up when I perform "strings a.out". I have tried examining particular memory addresses of interest ...
2
votes
1answer
995 views

Firmware-mod-kit says “No supported filesystem” along with strange and long output

I tried firmware-mod-kit's extract-firmware.sh script and I receive the following output which ends with "No supported filesystem found". The firmware belongs to the TL-WR740Nv5 router. The ...
2
votes
1answer
545 views

Given a program binary, how can I know which compiler it is compiled from?

Basically I have a set of 32-bit ELF program binaries compiled by either gcc or llvm. They are all stripped before analysis. My question is that, given a binary, is there any way I can determine ...
2
votes
1answer
378 views

Modifying a string in a .net binary

I have a .net exe called foo.exe I open foo in a hex editor (HxD) and search for myString. I do not see it. I open foo.exe in ILSpy and was able to find myString. I do see human readable text in the ...
2
votes
1answer
683 views

Does Windows 7 Pro use ASLR for win32 executable?

I unpacked a UPX packed PE binary. Both the packed and unpacked binary have fixed image base of 0x400000 (Checked by various PE tools). However, every time I run the program in OllyDbg, the image ...
2
votes
1answer
1k views

Anti reverse engineering tools that are easy to set up

I will be distributing a c++ application, and I was wondering if there was any tools available to add an extra layer of security against reverse engineering. I'm looking for a quick fix because I don'...
2
votes
0answers
1k views

Can IDA generate C code for ASM assembly wihtout the binary

Lets say I have this picture of some assembly: Now I know how to manual tranform this assembly into C code because it is small but is it possible for IDA to convert this into C code? Ideally I would ...
2
votes
1answer
189 views

Debugging Binary using Far Ret to switch Code Segment

It appears that GDB is unable to handle binaries which switch code segments. Using pwntools*, it's trivial to generate a 32-bit intel binary which uses retf to switch to the 64-bit code segment. ...
1
vote
2answers
267 views

3 questions on assembly - syntax, meaning, and equivalent in high level code (eg C++)

For the following example, using x86 code in AT&T format: xor $0x20, (%eax) and $0x20, %ah or $0x20, %dh dec (%edi) dec %si dec %sp dec %bp My understanding: Line 1: takes value in %eax and ...
1
vote
3answers
744 views

RE'ing a Binary

I have a laptop that I recently lost the BIOS Admin password for. I contacted the manufacturer and, after giving them some information about my BIOS (version, uuid), they sent me a file, smc.bin to ...
1
vote
1answer
479 views

What are the side effects of setting the timestamp in the PE-header to 0?

The PE-Header of Windows executables contains as its third field the "Timestamp at compile time". To reach reproducibility in our build process we would like to set the time (Epoch seconds) to zero (=...
1
vote
1answer
276 views

Variable liveness analysis on binaries

I want to detect all the variables live at any instruction/address in a binary. By variable, I refer to both global as well as function local variables. In other words, given a Linux ELF and a virtual ...
1
vote
1answer
181 views

How to change a string in a arm 32bit lsb executable binary using radare2?

I have a arm 32bit lsb executable which prints "hello world" to the screen. How do I change the string to "Good bye" using radare2. I believe this will teach me the basics of RE and radare2. Thank ...
1
vote
1answer
104 views

How to check proprietary firmware for GPL violation

I have a proprietary binary (firmware), and I'd like to check whether it contains opensource components. I'm thinking about extracting what it contains - probably binaries - and use strings, grep and ...
1
vote
1answer
680 views

Trying to identify a string in a strcmp instruction

Working to debug and analyze a piece of firmware, I've come across a bunch of cgi files which are all symlinked to a central cgi file. The first thing the main function does is run a series of string ...
1
vote
1answer
3k views

Reverse engineering binary file to find flag

The binary is from here: https://files.fm/u/qtqmhhdd I've been attempting this a couple of days. Its an ELF-64 bit file and I've gdb and IDA to see how it works for a while. You can run the file by ....
1
vote
1answer
251 views

In angr, how to Load and Analyze a binary file that only contain a function instructions

I have some binary files, each of them contain instructions of a function, (may be a little more in the end). The begining of the file also is the start point of the function. This files were ...
1
vote
2answers
694 views

Assembly - Binary Bomb Confusion

I have an assignment for reverse engineering a binary. The function I'm up to takes a string input and reads one character at a time. It is as follows (push/pop registers removed): 8048b6e: mov $...
1
vote
1answer
149 views

How to reverse engineer a Black Box?

I am trying to reverse engineer / research a black box system, this is, a system for which there is no public information at all. Let's say the system is a modern handheld console. I have already ...
1
vote
1answer
41 views

Assuming you know everything about a hardware platform, can you reverse the BLOB that is required for its operation? [closed]

I do not understand, if you know everything there is to be known about your hardware, can't you work your way up and find out what the binary does exactly?
1
vote
1answer
119 views

Is it possible to make a string bigger on an executable without breaking it?

I am a new reverse enigneerer. I know I can patch strings using a hex editor, but I obviously can't add or remove a single byte. Is there any workaround that will let me make a... let's say, 10 byte ...
1
vote
1answer
790 views

Basic clarifications about .hex and .bin file

I am newcomer to this field. I would like to understand how these things work and what these file contain (and if I'm on the right path). To explain my doubts, I will use the .hex file posted in a ...