Questions tagged [elf]

the Executable and Linkable Format is the main executable and object format for Linux, Solaris, *BSD, and many other OSes...

Filter by
Sorted by
Tagged with
-1
votes
0answers
20 views

setting an initial value for a bss variable in elf

With the following minimal example code #include <stdlib.h> #include <stdio.h> int zero = 0; int one = 1; int two = 2; void main(int argc, char *argv[]) { if(argc > 1) zero = ...
0
votes
1answer
39 views

“check:” keyword in Ghidra

I have disassembled the crackme0x06 challenge (http://security.cs.rpi.edu/courses/binexp-spring2015 inside challenges.zip). It's an ELF 32bit unstripped binary. The decompiled C code using Ghidra ...
0
votes
0answers
40 views

What does the file pointer of fgets actually point to in linux?

So i was reversing a 64 bit ELF binary, and it did a call to fgets, and based on documentation the third argument of fgets is a file pointer. now the weird part was that the third argument in this ...
0
votes
0answers
63 views

CHBByteStream operator<<, get only one argument - value

Anyone heard about CHBByteStream? It's from Harman headunit (car radio). I don't know how it's passing arguments. SWID is 4 bytes, VIN is 17 bytes, it should be connected in some way, to pass thru ...
2
votes
1answer
289 views

Ghidra python - get program base address

What is the way to get the program base address in Ghidra?
0
votes
1answer
59 views

Dumping the GOT with gdb at run time

I want to see how the plt stubs are being resolved at run time when lazy linking is used and how the GOT is changed along the way. How can I dump the GOT with gdb?
0
votes
1answer
64 views

Conditional to check bytes against user input [ELF 32-bit]

I'm trying to understand the following snippet code from a CTF binary. It is part of an ELF 32-bit and I decompiled it with Ghidra. undefined4 check_serial(char *code) { size_t sVar1; undefined4 ...
0
votes
1answer
114 views

Can “missing section headers” ELF files still be executed/dangerous?

On VirusTotal, there are lots of ELF samples are missing section headers when using file command to see the info. Also, when using the Python elftools library to parse them, exceptions will be thrown....
1
vote
1answer
128 views

GCC is not recognizing symbol table in my hand-made ELF file

For learning purposes I've created (using a hex editor and some macros) the following ELF file: hello.o: ELF 64-bit LSB relocatable, x86-64, version 1 (SYSV), not stripped xxd hello.o: 00000000: ...
2
votes
1answer
116 views

ELF imported symbols colision

From what I understand, the ELF format doesn't specify which symbols come from which file - Every ELF that uses import has a list of symbols to import and list of file names, and the loader is trying ...
1
vote
1answer
146 views

ELF file crashing after executing shellcode

So after changing the entry point via the e_entry field I managed to execute my shellcode before returning control to the original entry point. Here's how I did it: // write string and jump to OEP, ...
6
votes
2answers
151 views

Reassembling ELF binary files

I have been doing a number of CTF activities when I came across something I’m unfamiliar with. As I am somewhat new to exploitation and reverse engineering, this was unfamiliar to me. I have 7 pieces ...
2
votes
1answer
77 views

Importance of learning file structures for reverse engineering?

I'm new to reverse engineering and I have started to study the anatomy of specific file formats, specifically PE right now. I really enjoy learning the different parts of the files and the different ...
0
votes
1answer
66 views

Convert PIE ELF binary into No-PIE

Is it possible changing few bytes for converting an elf binary from PIE to No-PIE (ELF)? I know that in the header if e_type is: - 3 then the program is PIE - 2 then the program is No-PIE So I ...
3
votes
1answer
52 views

ELF file format find shared object for symbol

(in Windows) PE file format contains Import table with Module\Dll Name which tells PE loader where to search for symbol e.g. KERNEL32.dll -> CreateFileW In the ELF file format there is Symbol ...
4
votes
2answers
227 views

Struct reconstruction in decompilers

I'm testing several decompilers about struct reconstruction, given the following C example: struct S { int x; int y; long z; long t; }; int foo(struct S s) { return s.x + s.y + s....
1
vote
1answer
57 views

How to use x64-86 elf file from an apk file in a linux machine?

I'm building a jar file that use jni to load an x86-64 elf extracted from Android apk file. But when I run my app, it throw this exception: Caused by: java.lang.UnsatisfiedLinkError: /lib/x86_64-...
1
vote
1answer
78 views

Why is IDA showing three arguments for the main function instead of two in some linux binaries?

So I am reversing an ELF‌ binary, now from my knowledge in C the main function has two argument, argc and argv but some linux binaries that i am reversing have 3 when i decompile them! one int and ...
3
votes
1answer
73 views

IAT vs GOT address resolving: which of them resolve during runtime and which during load time by default?

So based on my knowledge on windows apps, as far as i know the IAT gets filled with correct addresses when the library gets loaded (correct me if I'm wrong) now in linux, they use GOT, and again ...
0
votes
1answer
48 views

problem rewriting ELF binary to add an additional loadable segment

I have a problem rewriting ELF binary to add an additional loadable segment for add.c code. I have problem working with https://pdfhost.io/v/U@uP1+nCY_Compact_Control_Flow_Integerity_in_Linuxpdf.pdf ...
0
votes
1answer
78 views

How to determine when/where pointers in .ctors get mapped?

So I am learning about ELF, and am looking through a binary in Ghidra as I do. I've made sense of the ELF header, and now I am looking through the program header table. My binary has a bunch of ...
1
vote
2answers
243 views

Elf x86_64 adding function

I'm trying to see if I can append function code in the .text section of an ELF while still maintaining the execution flow of the original ELF. Ideally, I want to call the new function but that's it's ...
2
votes
1answer
83 views

What is actually loaded here and different hexdump outputs on util-linux hexdump and on cutter and ghidra's hexdump

I was trying to understand what segment of file gets loaded by fourth LOAD header on phdr array. First 6 headers are shown below from readelf Program Headers: Type Offset ...
1
vote
1answer
194 views

Why have two symbols tables?

Why have two symbol tables if .symtab already contains everything that's in .dynsym ?
2
votes
1answer
287 views

Meaning of Flags in ELF Section header?

Given this classic helloworld.c example, #include <stdio.h> int main() { printf("Hello world!\n"); } In below sections output, the value for Flags presents a couple of different values, e....
2
votes
1answer
122 views

LD_BIND_NOW doesn’t seem to take effect on ELF PIE executable?

Observations When the Linux executable is compiled as PIE (Position Independent Executable, default on Ubuntu 18.04), the symbols from shared libraries (e.g. libc) will be resolved when the program ...
3
votes
1answer
220 views

ELF x86 - Why is return address pushed twice?

I reverse an ELF x86, and I would like to understand why the return address is pushed again on the stack? It should be already present there. main: lea ecx, [esp+0x4 {argc}] and esp, 0xfffffff0 ...
1
vote
1answer
375 views

Changing entry-point of and ELF file

I'm trying to conduct a little experiment which basically consists of changing the EP of an ELF file and executing an exit(9) syscall, without returning to the OEP. As shown in the image everything ...
-1
votes
1answer
444 views

How reverse a stripped binary (Find the main function)

I'm learning the reverse, and I'm trying to reverse a stripped binary (flag: ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, stripped). I manage to go to the entry address ...
1
vote
0answers
1k views

Reversing ELF 64-bit LSB pie executable [duplicate]

I have a file crackme, which is an executable. hamuto@hamuto-pc:~/Security/NOOB/FruitSalad$ file crackme crackme: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, ...
1
vote
1answer
294 views

How to find the starting address of main function when the binary is stripped and _start doesn't push the absolute address value of main?

So let's say the ELF binary is stripped - meaning no symbol table - and the _start function doesn't push the address of main before calling __libc_start_main. This happened in a binary when compiled ...
4
votes
1answer
109 views

How to find the index of static ilbrary functions in the PLT of the binary?

So right now I'm trying to resolve function calls and their names in my reversing tool the problem I'm having is that library functions such as printf and fwrite and such do not have a corresponding ...
2
votes
3answers
200 views

Is the main function's name in the symbol table of C & C++ programs always 'main'? if not, how to find the name?

So I'm trying to write a reversing tool that parses symbol table to find the main function's address right now all the binaries I'm checking the name of main function is still main in symbol table ...
1
vote
1answer
1k views

How do tools like objdump find names of functions and their start address in ELF binaries?

I have written a ELF parser that disassmbles the .text section using capstone my problem is that i dont know how can i segment the text section based on functions and print the name of the function ...
4
votes
2answers
874 views

Edit an ELF file (language pack)

I have here an ELF file that contains a language pack (Englisch and Chinese) and I want to swap the chinese language to the german language. hex cannot represent Chinese :) here an excerpt from the ...
0
votes
1answer
274 views

Disassembling Hexagon - Corrupted ELF

I downloaded and unpacked the modem from Google source, after that I used laginimaineb's script to unify all modem binary data. However, when loading this binary to IDA, I get an error says: "Binary ...
2
votes
0answers
51 views

Any way to edit an ELF binary without hex? [duplicate]

So, this is a noob question, I am a complete beginner in this field, so sorry if I'm wasting your time in any way. I wanted to know, if there is a way to edit an ELF binary without using a hex editor....
3
votes
1answer
3k views

How to export a working elf binary from Ghidra?

When patching a program and then using the export binary function, it turns the elf headers are corrupt. Is there any way to work around this problem?
-2
votes
1answer
44 views

DT_DEBUG not filled on dlopen [closed]

A target library "lib42.so" has DT_DEBUG entry in the .dynamic section. After dlopen("lib42.so", RTLD_LOCAL | RTLD_NOW) succeded, r_debug->d_un.d_ptr is equal to zero. Why?
0
votes
0answers
249 views

Find functions names in .init_array section in unstripped library

Is it possible to find out all instances of static initialization in a elf dynamic library. I can dump the array of function pointers in .init_array section via objdump command like this. objdump -s -...
0
votes
0answers
375 views

Finding function call (with arguments) in ELF file

I have two kinds of ELF files, built from C++. .so files: ELF 64-bit LSB shared object, x86-64, version 1 (GNU/Linux), dynamically linked, BuildID[sha1]=5e751e769912aef28bc63b888e5e4904b867a180, ...
1
vote
0answers
154 views

Need help understanding basic buffer overflow

So I have this sample problem that I need to buffer overflow. Its an elf file that require to be run on a separate terminal then using "nc localhost 'port' " on a separate terminal we can see the ...
2
votes
1answer
81 views

Process Immediately Killed

I'm trying to reverse an ARM executable. It's for an embedded system, but I don't have any details about the normally targeted environment. Here's what file shows: ELF 32-bit LSB executable, ARM, ...
0
votes
1answer
123 views

Is it possible to add a label to an ELF executable and then call that label? If so, how?

Let's say we have this simple "hello world" nasm code that will be compiled to an ELF executable: global main section .data message db "Hello World!", 0x00 section .text main: call ...
5
votes
1answer
987 views

Find function in a stripped dynamic ELF library

Im currently reverse engineering an android app and this app calls a function named "getUserInfo" in an ARM 32bit ELF library called "libcms.so" (from TikTok) via the Java Native Interface. My ...
3
votes
1answer
108 views

Enumerating (name, addresses) in PLT of an ELF file without elf.h

I want to show users imported symbols of a given ELF file like this(#1) in a disassembler project.(Android app) 1d21a: f7fa e8e8 blx 173ec ; __android_log_print@plt ... Currently, I can only show ...
1
vote
2answers
235 views

Get Multiple Function Names for One Address in IDA

I am trying to get a complete list of symbol names in IDA. All functions that return names operate primarily around looking at particular addresses and there corresponding entries in the symbol table, ...
0
votes
1answer
198 views

How to identify different memory regions of an elf binary in radare2?

I'm just starting out with reverse engineering, one thing I'm finding difficult is identifying different areas of memory. I'm using radare2, and I would like to be able to easily seek and identify ...
6
votes
2answers
1k views

Writing ELF headers in Radare?

Reading Keith Makan's, "Introduction to the ELF Format : The ELF Header", he modifies e_entry, The e_entry field lists the offset in the file where the program should start executing.Normally it ...
3
votes
2answers
518 views

How can I get the byte size of an operand in IDA Pro?

I am trying to get the byte size of all operands in a given instruction from IDA Pro. At first I tried using GetOperandValue(ea,n) to see how large the value was and calculate how many bytes were ...