Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [elf]

the Executable and Linkable Format is the main executable and object format for Linux, Solaris, *BSD, and many other OSes...

2
votes
1answer
35 views

Meaning of Flags in ELF Section header?

Given this classic helloworld.c example, #include <stdio.h> int main() { printf("Hello world!\n"); } In below sections output, the value for Flags presents a couple of different values, e....
2
votes
1answer
39 views

LD_BIND_NOW doesn’t seem to take effect on ELF PIE executable?

Observations When the Linux executable is compiled as PIE (Position Independent Executable, default on Ubuntu 18.04), the symbols from shared libraries (e.g. libc) will be resolved when the program ...
3
votes
1answer
133 views

ELF x86 - Why is return address pushed twice?

I reverse an ELF x86, and I would like to understand why the return address is pushed again on the stack? It should be already present there. main: lea ecx, [esp+0x4 {argc}] and esp, 0xfffffff0 ...
1
vote
1answer
102 views

Changing entry-point of and ELF file

I'm trying to conduct a little experiment which basically consists of changing the EP of an ELF file and executing an exit(9) syscall, without returning to the OEP. As shown in the image everything ...
-1
votes
1answer
102 views

How reverse a stripped binary (Find the main function)

I'm learning the reverse, and I'm trying to reverse a stripped binary (flag: ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, stripped). I manage to go to the entry address ...
1
vote
0answers
35 views

Reversing ELF 64-bit LSB pie executable [duplicate]

I have a file crackme, which is an executable. hamuto@hamuto-pc:~/Security/NOOB/FruitSalad$ file crackme crackme: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, ...
0
votes
1answer
60 views

How to find the starting address of main function when the binary is stripped and _start doesn't push the absolute address value of main?

So let's say the ELF binary is stripped - meaning no symbol table - and the _start function doesn't push the address of main before calling __libc_start_main. This happened in a binary when compiled ...
3
votes
1answer
65 views

How to find the index of static ilbrary functions in the PLT of the binary?

So right now I'm trying to resolve function calls and their names in my reversing tool the problem I'm having is that library functions such as printf and fwrite and such do not have a corresponding ...
1
vote
3answers
110 views

Is the main function's name in the symbol table of C & C++ programs always 'main'? if not, how to find the name?

So I'm trying to write a reversing tool that parses symbol table to find the main function's address right now all the binaries I'm checking the name of main function is still main in symbol table ...
0
votes
1answer
154 views

How do tools like objdump find names of functions and their start address in ELF binaries?

I have written a ELF parser that disassmbles the .text section using capstone my problem is that i dont know how can i segment the text section based on functions and print the name of the function ...
3
votes
2answers
135 views

Edit an ELF file (language pack)

I have here an ELF file that contains a language pack (German and Chinese) and I want to swap the chinese language to the german language. hex cannot represent Chinese :) here an excerpt from the ...
0
votes
1answer
130 views

Disassembling Hexagon - Corrupted ELF

I downloaded and unpacked the modem from Google source, after that I used laginimaineb's script to unify all modem binary data. However, when loading this binary to IDA, I get an error says: "Binary ...
0
votes
0answers
46 views

Any way to edit an ELF binary without hex? [duplicate]

So, this is a noob question, I am a complete beginner in this field, so sorry if I'm wasting your time in any way. I wanted to know, if there is a way to edit an ELF binary without using a hex editor....
1
vote
0answers
891 views

How to export a working elf binary from Ghidra?

When patching a program and then using the export binary function, it turns the elf headers are corrupt. Is there any way to work around this problem?
-2
votes
1answer
25 views

DT_DEBUG not filled on dlopen [closed]

A target library "lib42.so" has DT_DEBUG entry in the .dynamic section. After dlopen("lib42.so", RTLD_LOCAL | RTLD_NOW) succeded, r_debug->d_un.d_ptr is equal to zero. Why?
0
votes
0answers
75 views

Find functions names in .init_array section in unstripped library

Is it possible to find out all instances of static initialization in a elf dynamic library. I can dump the array of function pointers in .init_array section via objdump command like this. objdump -s -...
0
votes
0answers
71 views

Finding function call (with arguments) in ELF file

I have two kinds of ELF files, built from C++. .so files: ELF 64-bit LSB shared object, x86-64, version 1 (GNU/Linux), dynamically linked, BuildID[sha1]=5e751e769912aef28bc63b888e5e4904b867a180, ...
1
vote
0answers
81 views

Need help understanding basic buffer overflow

So I have this sample problem that I need to buffer overflow. Its an elf file that require to be run on a separate terminal then using "nc localhost 'port' " on a separate terminal we can see the ...
2
votes
1answer
69 views

Process Immediately Killed

I'm trying to reverse an ARM executable. It's for an embedded system, but I don't have any details about the normally targeted environment. Here's what file shows: ELF 32-bit LSB executable, ARM, ...
0
votes
1answer
85 views

Is it possible to add a label to an ELF executable and then call that label? If so, how?

Let's say we have this simple "hello world" nasm code that will be compiled to an ELF executable: global main section .data message db "Hello World!", 0x00 section .text main: call ...
2
votes
1answer
313 views

Find function in a stripped dynamic ELF library

Im currently reverse engineering an android app and this app calls a function named "getUserInfo" in an ARM 32bit ELF library called "libcms.so" via the Java Native Interface. My Problem is: The ...
2
votes
1answer
55 views

Enumerating (name, addresses) in PLT of an ELF file without elf.h

I want to show users imported symbols of a given ELF file like this(#1) in a disassembler project.(Android app) 1d21a: f7fa e8e8 blx 173ec ; __android_log_print@plt ... Currently, I can only show ...
1
vote
2answers
111 views

Get Multiple Function Names for One Address in IDA

I am trying to get a complete list of symbol names in IDA. All functions that return names operate primarily around looking at particular addresses and there corresponding entries in the symbol table, ...
0
votes
1answer
89 views

How to identify different memory regions of an elf binary in radare2?

I'm just starting out with reverse engineering, one thing I'm finding difficult is identifying different areas of memory. I'm using radare2, and I would like to be able to easily seek and identify ...
6
votes
2answers
987 views

Writing ELF headers in Radare?

Reading Keith Makan's, "Introduction to the ELF Format : The ELF Header", he modifies e_entry, The e_entry field lists the offset in the file where the program should start executing.Normally it ...
3
votes
1answer
244 views

How can I get the byte size of an operand in IDA Pro?

I am trying to get the byte size of all operands in a given instruction from IDA Pro. At first I tried using GetOperandValue(ea,n) to see how large the value was and calculate how many bytes were ...
1
vote
1answer
72 views

Unable to resolve the symbols for a statically linked binary in IDA Pro

I have a statically linked binary which is stripped. When I load it in IDA Pro, I don't see the function names as expected. I generated the sig file for libc on the Linux machine on which the program ...
0
votes
1answer
295 views

IDA Pro is showing Function names for a Stripped Binary

I have an ELF 32-bit binary and it is a stripped binary. Yet, when I load with IDA Pro, I can see the function names like write, open, malloc and so on. So, I am trying to understand if the binary is ...
2
votes
2answers
3k views

Find base address and memory size of program debugged in gdb

I want to find out the base address and the imagesize of the program being debugged in gdb. As in, where it got loaded in memory. For shared libraries I can do "info sharedlibrary" and I get very ...
3
votes
1answer
86 views

Importance of Compiler Version in generating a signature

I load a reference elf that I cross-compiled for AArch64 into IDA Pro, idb2pat to generate a .pat which I then process through sigmake. I then use the signature file (in the appropriate IDA Pro ...
1
vote
0answers
41 views

Legal Reverse Engineering for Security Review in US for Korean Provided Module

My company has received a command-line stand-alone (ELF) executable from a Korean company that provides a service for validating Korean users. It took them a few tries to get us a version that runs on ...
2
votes
1answer
135 views

How can you get the symbol visibility with radare?

I created a quick x86_64 Assembly file with NASM to generate the four different visibility classes for ELF 64. With readelf --symbols I get the Symbol Visibility in the Vis column: DEFAULT, INTERNAL, ...
1
vote
2answers
888 views

Can't find the password anywhere in the binary

This is my first post here. I was recently involved in a capture the flag preparation test which involved decompiling an ELF 32-bit LSB executable, Intel 80386 file for Linux compiled with GCC. The ...
2
votes
1answer
253 views

ELF - The start address of .got section is different from the entry point address of the GOT(global offset table)

I used readelf to read the information of the ELF file. I found the address of .got section in the section header is different from the GOT entry point address read from the dynamic section. Is the ...
4
votes
1answer
225 views

What are the first 16 bytes in .rodata section?

What are the first 16 bytes in the .rodata section? For example, I have the following code: #include <cstdio> void myprintf(const char* ptr) { printf("%p\n", ptr); } int main() { ...
1
vote
1answer
88 views

What are these LOAD segments in an assembly ELF64?

I wrote the following (fasm) assembly program: format ELF64 executable segment readable executable include 'io.inc' include 'unistd64.inc' entry main main: mov rdi, msg call print call ...
1
vote
1answer
675 views

IDA - Remote debug on linux

I am trying to debug remotly an ELF from my windows 10 (the ELF runs on my ubuntu 32 bit vm) (the ELF is from pwnable.kr - unlink). Because the exploit is via gets() I try to pass input through the "...
1
vote
1answer
456 views

Radare2 - Insert asm instructions without overwriting

In order to patch a x86 elf file on Linux, I'm struggling to insert a specific assembler instruction into the binary file without overwriting any of the preexisting instructions. I've been reading ...
1
vote
1answer
59 views

Why would an ELF SHT_REL section contain relocations outside the section its sh_info refers to?

I have a .so from an Android JNI/NDK application. Here are two of its sections: [Nr] Name Type Addr Off Size ES Flg Lk Inf Al [10] .rel.plt REL ...
4
votes
1answer
60 views

What does a C++ identifier ending in $_## mean?

In trying to understand a .so from an Android game made with Cocos2d-x, I've come across identifiers like the following (after demangling): SceneActionMap::updateTalkMode(float)::$_37 SceneActionMap::...
1
vote
0answers
166 views

Unknown Game Client Data

As asking a friend and no amount of Googling yielded an answer, I figured I'd make an account and give this place a go. I'm working on reverse engineering the server for a relatively old game with no ...
4
votes
1answer
197 views

How do I find out what section variables and strings are defined in?

Given a simple program like this, void main (int argc, char * argv[] ) { char * arr[] = {"foo", "bar", "baz"}; *(arr[0]) = 'F'; printf( "%s", arr[0] ); } How do I find out what section ...
4
votes
1answer
204 views

Determine if an ELF file is signed or not

I need some help in determining if an ELF file is signed or with a valid signature or not. I have used the readelf tool with -S option in order to view the section headers and more specifically, the ...
1
vote
0answers
55 views

Are there tools or plugins for IDA Pro that can find ELF sections?

I'm trying to use data from one ELF to build another ELF, but I can't seem to find anything that gets what I need using IDA Pro. I'm trying to build a database out of Sections, Symbols, and Cross-...
1
vote
1answer
334 views

Is IDA resolving ELF relocations correctly?

While working on this kernel module, I noticed IDA somehow resolves some ELF relocations statically. Consider the symbol sys_renameat, which, according to IDA, resides at 0x8000720 in .bss segment. ...
2
votes
1answer
143 views

Position-independent code dectection

Is it possible to detect whether a given executable is a PIC by looking at the disassembler's output? If not, what are other valid ways to go about this?
1
vote
1answer
85 views

Build Graph Printable String Information in ELF

I'm new in the field of reverse engineering to detect malicious code in ELF file. I used IDA Pro to retrieve a list of strings in an elf file. But I wonder if IDA can build a graph showing the link ...
1
vote
0answers
191 views

ELF .text infection test

I'm trying to implement an example of an ELF .text infection as described in "Learning Linux Binary Analysis". I'm currently having a problem where I successfully injected my data into the .text ...
3
votes
3answers
2k views

Start analysis at any position in elf is Entry Point?

An entry point is considered to be the first point to be made in a program. So if I start at any position in the program to start analyzing it can be considered an entry point is not ?? please help ...
0
votes
1answer
319 views

Radare2 create section

Radare2 has S* commands, that can show, delete, modify sections. Is it possible to create new section in executable file and save it?