Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [elf]

the Executable and Linkable Format is the main executable and object format for Linux, Solaris, *BSD, and many other OSes...

1
vote
2answers
54 views

Get Multiple Function Names for One Address in IDA

I am trying to get a complete list of symbol names in IDA. All functions that return names operate primarily around looking at particular addresses and there corresponding entries in the symbol table, ...
0
votes
0answers
35 views

LD_PRELOAD, doesn't work every time

I mean that when using LD_PRELOAD to replace a libc function, it does not always replace. (Unfortunately, it serves me in challenges). So my question would be: Are there any configurations that ...
0
votes
0answers
28 views

How could a function stored into a static variable be used without an explict call at any point?

Disclaimer: I'm new to RE and I'm trying to hone my skills. I'm trying to reverse some C code and I noticed the following instructions (x86) that store a function into a static variable in the .bss ...
0
votes
1answer
31 views

How to identify different memory regions of an elf binary in radare2?

I'm just starting out with reverse engineering, one thing I'm finding difficult is identifying different areas of memory. I'm using radare2, and I would like to be able to easily seek and identify ...
5
votes
2answers
657 views

Writing ELF headers in Radare?

Reading Keith Makan's, "Introduction to the ELF Format : The ELF Header", he modifies e_entry, The e_entry field lists the offset in the file where the program should start executing.Normally it ...
3
votes
1answer
114 views

How can I get the byte size of an operand in IDA Pro?

I am trying to get the byte size of all operands in a given instruction from IDA Pro. At first I tried using GetOperandValue(ea,n) to see how large the value was and calculate how many bytes were ...
1
vote
1answer
51 views

Unable to resolve the symbols for a statically linked binary in IDA Pro

I have a statically linked binary which is stripped. When I load it in IDA Pro, I don't see the function names as expected. I generated the sig file for libc on the Linux machine on which the program ...
0
votes
1answer
90 views

IDA Pro is showing Function names for a Stripped Binary

I have an ELF 32-bit binary and it is a stripped binary. Yet, when I load with IDA Pro, I can see the function names like write, open, malloc and so on. So, I am trying to understand if the binary is ...
2
votes
2answers
404 views

Find base address and memory size of program debugged in gdb

I want to find out the base address and the imagesize of the program being debugged in gdb. As in, where it got loaded in memory. For shared libraries I can do "info sharedlibrary" and I get very ...
3
votes
1answer
42 views

Importance of Compiler Version in generating a signature

I load a reference elf that I cross-compiled for AArch64 into IDA Pro, idb2pat to generate a .pat which I then process through sigmake. I then use the signature file (in the appropriate IDA Pro ...
1
vote
0answers
37 views

Legal Reverse Engineering for Security Review in US for Korean Provided Module

My company has received a command-line stand-alone (ELF) executable from a Korean company that provides a service for validating Korean users. It took them a few tries to get us a version that runs on ...
2
votes
1answer
70 views

How can you get the symbol visibility with radare?

I created a quick x86_64 Assembly file with NASM to generate the four different visibility classes for ELF 64. With readelf --symbols I get the Symbol Visibility in the Vis column: DEFAULT, INTERNAL, ...
0
votes
2answers
390 views

Can't find the password anywhere in the binary

This is my first post here. I was recently involved in a capture the flag preparation test which involved decompiling an ELF 32-bit LSB executable, Intel 80386 file for Linux compiled with GCC. The ...
2
votes
1answer
93 views

ELF - The start address of .got section is different from the entry point address of the GOT(global offset table)

I used readelf to read the information of the ELF file. I found the address of .got section in the section header is different from the GOT entry point address read from the dynamic section. Is the ...
4
votes
1answer
139 views

What are the first 16 bytes in .rodata section?

What are the first 16 bytes in the .rodata section? For example, I have the following code: #include <cstdio> void myprintf(const char* ptr) { printf("%p\n", ptr); } int main() { ...
1
vote
1answer
40 views

What are these LOAD segments in an assembly ELF64?

I wrote the following (fasm) assembly program: format ELF64 executable segment readable executable include 'io.inc' include 'unistd64.inc' entry main main: mov rdi, msg call print call ...
1
vote
1answer
274 views

IDA - Remote debug on linux

I am trying to debug remotly an ELF from my windows 10 (the ELF runs on my ubuntu 32 bit vm) (the ELF is from pwnable.kr - unlink). Because the exploit is via gets() I try to pass input through the "...
1
vote
1answer
164 views

Radare2 - Insert asm instructions without overwriting

In order to patch a x86 elf file on Linux, I'm struggling to insert a specific assembler instruction into the binary file without overwriting any of the preexisting instructions. I've been reading ...
1
vote
1answer
34 views

Why would an ELF SHT_REL section contain relocations outside the section its sh_info refers to?

I have a .so from an Android JNI/NDK application. Here are two of its sections: [Nr] Name Type Addr Off Size ES Flg Lk Inf Al [10] .rel.plt REL ...
4
votes
1answer
57 views

What does a C++ identifier ending in $_## mean?

In trying to understand a .so from an Android game made with Cocos2d-x, I've come across identifiers like the following (after demangling): SceneActionMap::updateTalkMode(float)::$_37 SceneActionMap::...
1
vote
0answers
122 views

Unknown Game Client Data

As asking a friend and no amount of Googling yielded an answer, I figured I'd make an account and give this place a go. I'm working on reverse engineering the server for a relatively old game with no ...
4
votes
1answer
90 views

How do I find out what section variables and strings are defined in?

Given a simple program like this, void main (int argc, char * argv[] ) { char * arr[] = {"foo", "bar", "baz"}; *(arr[0]) = 'F'; printf( "%s", arr[0] ); } How do I find out what section ...
4
votes
1answer
85 views

Determine if an ELF file is signed or not

I need some help in determining if an ELF file is signed or with a valid signature or not. I have used the readelf tool with -S option in order to view the section headers and more specifically, the ...
1
vote
0answers
42 views

Are there tools or plugins for IDA Pro that can find ELF sections?

I'm trying to use data from one ELF to build another ELF, but I can't seem to find anything that gets what I need using IDA Pro. I'm trying to build a database out of Sections, Symbols, and Cross-...
1
vote
1answer
144 views

Is IDA resolving ELF relocations correctly?

While working on this kernel module, I noticed IDA somehow resolves some ELF relocations statically. Consider the symbol sys_renameat, which, according to IDA, resides at 0x8000720 in .bss segment. ...
1
vote
0answers
66 views

Position-independent code dectection

Is it possible to detect whether a given executable is a PIC by looking at the disassembler's output? If not, what are other valid ways to go about this?
1
vote
1answer
63 views

Build Graph Printable String Information in ELF

I'm new in the field of reverse engineering to detect malicious code in ELF file. I used IDA Pro to retrieve a list of strings in an elf file. But I wonder if IDA can build a graph showing the link ...
1
vote
0answers
131 views

ELF .text infection test

I'm trying to implement an example of an ELF .text infection as described in "Learning Linux Binary Analysis". I'm currently having a problem where I successfully injected my data into the .text ...
3
votes
3answers
680 views

Start analysis at any position in elf is Entry Point?

An entry point is considered to be the first point to be made in a program. So if I start at any position in the program to start analyzing it can be considered an entry point is not ?? please help ...
0
votes
0answers
225 views

IDA remote debugger on linux “input is a dynamic library…”

I am trying to understand how to debug with the remote debugger of IDA on linux. I tried to debug the bof challenge of pwnable.kr (http://pwnable.kr/bin/bof). It is a 32-bit ELF, so I could not run ...
0
votes
1answer
168 views

Radare2 create section

Radare2 has S* commands, that can show, delete, modify sections. Is it possible to create new section in executable file and save it?
0
votes
1answer
237 views

Parsing .rodata (ELF)

IDA pro is able to display the data contained in the read only data section of ELF files, but the section is defined as type SHT_PROGBITS. To my knowledge, we cannot parse sections of this type to ...
0
votes
1answer
74 views

How does IDA create COMMON, ABS and EXTERN segments of ELF-file?

Some symbols (from symbol table) in ELF-file belong to special sections (COMMON, ABS, UNDEF). IDA creates virtual sections for this symbols. Subject: What is the rule (or set of rules) which IDA use ...
0
votes
1answer
689 views

How to exploit an suid root application

I have to exploit an application and I have only the 32-bit ELF excecutable, which is also stripped. Its a suid root application and when it is executed practically run the ls -al command for a ...
1
vote
1answer
234 views

How to find ELF symbol table reference?

In a huge ELF binary, I find some functions which use some kind of (string) constant. The constant itself seems to be stored inside the binary itself but I can't figure out, how to resolve IDA's ...
0
votes
1answer
119 views

ELF64 Reflective Loading [closed]

I'm looking for an ELF64 reflective loader, so I can download an ELF and execute it without saving to disk? Is anyone able to point me at one please? Or a clear one for ELF32 so I can translate? ...
1
vote
1answer
197 views

How do you compile a C program with missing symbols?

In Learning Linux Binary Analysis by Ryan "elfmaster" O'Neill. On Page 33, the author compiles a program with a symbol reference and no definition, Let's take a look at the source code: _start() ...
1
vote
1answer
402 views

Elf file format finding .got and .got.plt segments

I'm writing ELF parser and simple disassembler x86. Having code like this .text:000B5A2A call 0000B470 ;e.g. _glXSwapBuffers ... ... got.plt:0000B470 jmp dword ptr [ebx+240h] ;jump to ....
5
votes
1answer
229 views

Difference between 'readelf' and 'radare2' addresses

I have an MIPS binary file that I want to analyze. I am having a little trouble understanding the way elfread and r2 interpret the adressing scheme from a binary. For example, r2 finds a function ...
2
votes
1answer
447 views

objdump -T gives Invalid Operation on MIPS .so

I have a MIPS .so file that I'm trying to reverse. Binary Ninja (too cheap for IDA) finds no symbols, and neither does objdump -T, instead giving "Invalid Operation": % mips-linux-gnu-objdump -x ...
0
votes
0answers
198 views

ELF hook function by address

I used this to intercept (https://github.com/asLody/ElfHook). Everything is simple enough, but here's the question. Let's say I want to intercept a function, not by its name, by its address, as in the ...
0
votes
0answers
45 views

How to call method from other compiled executable

I want to bruteforce an application with something like serial number verification. For performance reason, I want to call only one specific function. I see two possibilities: Export this one ...
2
votes
1answer
160 views

Debugging Binary using Far Ret to switch Code Segment

It appears that GDB is unable to handle binaries which switch code segments. Using pwntools*, it's trivial to generate a 32-bit intel binary which uses retf to switch to the 64-bit code segment. ...
1
vote
1answer
1k views

Address to file offset

I have read st_value from the ELF symbol table, with the value being 4195622. When converted to hex, the value is 400580. I am aware that the file offset is 580 bytes. My question is how to actually ...
2
votes
1answer
663 views

Disassemblers resolving (ELF) section names

I'm working with linux executables and was just wondering how it is that section names are resolved to addresses upon disassembly of an ELF. For example take some random disassembly output from ...
0
votes
1answer
268 views

ARM ELF Obfuscation [closed]

Metamorphic is a technique to obfuscate a binary and change the opcode sequence and create new samples with same functionality. In my case, I have some elf binary of ARM processor type and their ...
1
vote
0answers
401 views

My core dump's backtrace stops to a signal handler, what can I do?

I obtained an ELF core dump that was provoked by fuzzing a proprietary server. As I do not have access anymore to the machine that hosted this server, and the server is part of a tightly coupled set ...
0
votes
0answers
42 views

Function Call to function not in file?

Trying to reverse engineer an ARMv7 ELF file. There seems to be a function, that populates a ptr, but, the function does not seem to be located within the file. I know the ptr is in fact populated, ...
6
votes
1answer
871 views

Understanding gdb output

So I was messing with gdb and came across something rather interesting. I ran the following code into gdb: int i, g = 1; for (i = 0; i < 100; i++) g++; Before execution, disas main ...
4
votes
2answers
918 views

How do I approach this CTF Debugging Program?

I have an ELF executable I'm working on (got it from a previous CTF competition). The executable simply asks for a password, and then it prints out "congrats". The code snippets and my annotations ...