Questions tagged [elf]

the Executable and Linkable Format is the main executable and object format for Linux, Solaris, *BSD, and many other OSes...

Filter by
Sorted by
Tagged with
0 votes
0 answers
29 views

How can i get the address of a function in memory?

I am currently completing a CTF exercise where i must attempt to overwrite a function pointer on the stack through a buffer overflow here is the code: #include <err.h> #include <stdio.h> #...
0 votes
0 answers
13 views

Intercepting a PHP module with frida

I have a PHP module, and I'm trying to hook the functions of that module. ... 39: 0000000000024a60 1858 FUNC LOCAL DEFAULT 12 zim_ClassName_ClassName_exec ... 90: 0000000000028f10 8 ...
  • 156
0 votes
0 answers
32 views

how to hide all export functions in a elf so library?

I have this game I want to patch, the game server executable loads a elf so library with functions. I want to add new functions into this library so I patched the game server executable with elfpatch ...
0 votes
1 answer
58 views

Reverse engineering ELF: The e_phentsize field in the ELF header is less than the size of an ELF program header

I have extracted the .so binary libTheArmKing.so (located in lib directory in apk file) from a hack of World War Heroes game (an Android game) from Plantimod Forum. file output: libTheArmKing.so: ELF ...
1 vote
0 answers
43 views

Wrong EP on an .elf CrackMe

I am trying to solve an elf CrackMe. I opened it with IDA Pro and I saw start function is on address 0x1E8. I opened the elf with HxD and I saw entry point is 0x1E9 (and no results on file for 01E8)......
0 votes
0 answers
18 views

Patching a B(ranch) causes segfault in ARMv7 binary, while the same patch (with JMP) works on x64 binary

Any ideas why trying to patch a ARMv7 binary causes a segfault while basically the same patch on the Win64 version of the software works as expected? Here is the Win64 version, that works UPX0:...
5 votes
1 answer
375 views

What's the format of Mediatek MRE VXP file and how to create a workable VXP binary?

Background Mediatek's MRE (MAUI Runtime Environment) is the default runtime on Nokia S30+ platform, replacing the J2ME platform on older Nokia. From MRE's page: MRE (MAUI Runtime Environment) is a ...
0 votes
0 answers
203 views

Basic buffer-overflow on a remote program with Python/pwntools

I work on a online program in which I should do a buffer Overflow. When I run the program, I have to complete a sum of two numbers generated randomly) : >>> 451389913 + 1587598959 = If I put ...
  • 101
0 votes
0 answers
51 views

Normal artifact or something else?

I'm working on a Linux ELF challenge. I have found this bit of code in the .text disassembly using objdump -d -M intel program 922: 83 c4 10 add esp,0x10 925: c7 45 f4 00 00 00 ...
  • 101
1 vote
1 answer
146 views

Ida cannot open. a files of esp32 (Xtensa)

I tried to open this file with IDA Pro https://github.com/espressif/esp32-wifi-lib/blob/master/esp32/libpp.a Ida detect that is ELF for Xtensa (relocatable) But when I tired to open it I got Undefined ...
0 votes
2 answers
226 views

Reversing an obfuscation through a long linear switch statement

I have a program (ELF, 32 bits) that is probably quite short and simple, but which have been obfuscated with the following construction: i = 0 switch(i): case 0: one small instruction ...
1 vote
1 answer
160 views

Figure out method name with _dl_runtime_resolve_xsavec

I have a packed Linux shared library that decrypts function stub with INIT_ARRAY. When it's decrypted I'm unable to determine the method name. All method calls are redirected with relocation table. ...
  • 123
1 vote
0 answers
97 views

silvio packer for shared libray leads to error: "ELF load command address/offset not properly aligned"

I'm trying to implement a packer based on silvio infection. The packer works fine for ET_EXEC. However, it failed with "ELF load command address/offset not properly aligned" error for the ...
  • 71
1 vote
0 answers
51 views

failed to trigger packer's loader by overwritting the entry of rela.dyn on aarch64

I have implemented packer of x86_64 shared library. Briefly, a loader is injected to a shared library, and the rela.dyn entry is modified such that it points to the address of the loader. Once the ...
  • 71
3 votes
1 answer
154 views

Code caves in arm assembly

In a disassembled elf binary i found these arm thumb instructions: function0 0x002cc3a8 8079 ldrb r0, [r0, #6] 0x002cc3aa 7047 bx lr In the codecave these were the initial hex ...
  • 144
2 votes
0 answers
97 views

How do relocations work for imported functions in SH4 ELF?

I build very simple hello world code with sh4 gcc compiler as shared library: #include <stdio.h> void hello() { printf("Hello world!\n"); } But when I load .so file into the ...
  • 1,770
0 votes
1 answer
407 views

Running ELF file built for ARM arhitecture

My goal is to run and debug ELF file (c444) which is compiled for the ARM architecture. I have some experience with x32 and x64 Intel architectures. However, I down know how to proceed with ARM-based ...
0 votes
1 answer
196 views

What does this function do?

I'm trying to understand what client sends to server. I already did most of the work, but one function left. I can't understand what to do with this function and what it does. I've tried to change ...
  • 1
4 votes
2 answers
3k views

How to decompile external functions of *.so library in ELF with Ghidra?

There are some *.so libraries in my ELF file. I can see the *.so names in "Imports" directory of "Symbol Tree" Window in Ghidra tool. I think there are some external functions in ...
2 votes
1 answer
755 views

How can I find an external function code correctly in Ghidra and Radare2?

This is a code to call an external function(get_random_name) in the main function push {fp, lr} add fp, sp, 4 sub sp, sp, 0x1d8 str r0, [fp, -0x1d8] str r1, [fp, -0x1dc] sub r3, fp, 0x44 ...
2 votes
2 answers
505 views

How to reverse engineering ARM architecture ELF file on AMD linux?

I am reversing an ELF file, it's ARM architecture file. But my OS is AMD linux. How can I do reversing work for the ARM ELF file on AMD linux?
1 vote
2 answers
658 views

Is it possible to reverse CGI binary file?

I wanna reverse CGI binary file. Is it possible? What are the recommended tools and guides? Thank you for reading my question. $ file test.cgi status.cgi: ELF 32-bit LSB executable, ARM, EABI5 ...
1 vote
1 answer
1k views

How to disable relro while compilation?

#include <stdio.h> #include <stdlib.h> int main(int argc, int *argv[]) { size_t *p = (size_t *) strtol(argv[1], NULL, 16); p[0] = 0xDEADBEEF; printf("RELRO: %p\n", p); return ...
  • 23
1 vote
1 answer
2k views

startup program exits with code 126 when executing program at entrypoint

I want to reverse engineer a program. I managed to find the entry point but every time I want to launch the application I get the same error `During startup program exited with code 126. Here is what ...
1 vote
0 answers
334 views

Tool/parser for symbol tables produced with objdump -t to be used with IDA / Ghidra?

Working with a binary (arm64) file that seems to be some sort of a broken ELF file. The header data is missing and for some reason it contains a symbol table in a format that to me seem to be equal to ...
2 votes
1 answer
304 views

Can't modify string in radare2 (.rodata section)

I was following the response to this question to change the string of an elf executable. No matter how many times I try, I just can't modify the string. I notice that probably the issue lies in the ...
  • 153
1 vote
1 answer
73 views

Is an ELF SHT_RELA section with a 0 `sh_link` valid?

I have an 64-bit s390x ELF binary with a RELA section named ".rela.plt" whose sh_link field is 0. I was under the impression that the sh_link is a required value, providing the id of the ...
1 vote
1 answer
89 views

How to split bytes into instructions in binary ELF file for x86

I'm working on a static code injector for ELF files. I need to "steal" some bytes in order to write jump to my code on their place and then execute stolen instructions somewhere in the ...
1 vote
1 answer
239 views

Injecting code into an ELF binary , got Segmentation fault(SIGSEGV)

I am currently working on an ELF-injector and my approach is standard: find code cave (long enough sequence of 0's), rewrite it with the instructions I want to execute and then jump back to the start ...
  • 13
0 votes
1 answer
61 views

What does this custom piece of frame manipulation code from a router binary do?

I've decompiled a custom router ELF binary using Hex-Rays and have recently come across the following function in the binary: pkt_hdr_t *__cdecl pkt_hdr_from_frame(frame_t *frame, uint16_t *remaining) ...
  • 257
0 votes
1 answer
117 views

Call libc functions from the payload statically injected into ELF binary

I am working on ELF-injector, which given some payload (currently it's an assembly file with .text section only) will inject it into ELF binary. I had related post here. Now I would like to make it ...
4 votes
1 answer
921 views

ELF binary injection

I am currently working on an ELF-injector and my approach is standard: find code cave (long enough sequence of 0's), rewrite it with the instructions I want to execute and then jump back to the start ...
1 vote
1 answer
75 views

Name other than ".text" for the main code section

Is it safe to assume that, in the general case, the name of the section containing the user code (not the compiler generated code) is .text? I spot-checked several ARM, x86 and MIPS binaries (PE and ...
  • 1,456
1 vote
0 answers
157 views

Dynamic Analysis with gdb on ELF binaries with no compilation/linking information

I am trying to do some dynamic analysis on a couple of ELF binaries with gdb. However, since those two are directly downloaded (ELF binary file only) with no additional information related to ...
  • 11
-1 votes
1 answer
926 views

Extract PYZ Error

I successfully recovered some PYC files from an ELF built by PyInstaller (https://github.com/extremecoders-re/pyinstxtractor/wiki/Extracting-Linux-ELF-binaries). There is a PYZ archive in the dump. I ...
  • 99
0 votes
1 answer
143 views

How do i identify parameters function of md5sum of specific binary?

So, i downloaded the binary. Here are some details before moving forward: revbinary: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2,...
1 vote
2 answers
121 views

What is the state of the stack in the entry function?

I have an ELF binary and in the entry function the first two instructions are: XOR EBP, EBP POP ESI I'm curious what the state of the stack is at the start of the entry function in ELF and PE ...
2 votes
2 answers
280 views

debugging an older version of libc

I'm trying to understand heap exploitation better. Therefore, I compiled the following file: https://github.com/shellphish/how2heap/blob/master/glibc_2.25/fastbin_dup_into_stack.c I have the newest ...
  • 21
0 votes
0 answers
771 views

Modify Strings in a ELF (Executable and Linking Format) that are stored in the .rodata

I have 2 ELF files here, each containing strings in the ".rodata" for an translation that I want to modify. The first ELF "(binary1)" I have already successfully modified from ...
  • 73
1 vote
1 answer
2k views

How to open new window of decompiler or resize the decompiler of Ghidra?

This is very small and inconvenient to read. How do i open new Window (any shortcut key) or resize it, for some reason i cant resize. Any help? EDIT: Oh thanks Shane Riley, i clicked the blue button ...
0 votes
1 answer
222 views

Generating an elf header

To get a basic understanding of the ELF format, I'm writing a basic program to generate a valid elf file from the most basic assembly output. I'm going step-by-step so I'll probably ask a few ...
  • 103
1 vote
0 answers
72 views

Statically injecting translated NASM assembly into existing ELF binary

I'm trying to statically patching ELF binaries in order to incorporate code that can help provide run-time protection. In an effort to save time writing and debugging assembly, I took the following no-...
  • 111
0 votes
0 answers
102 views

How is ELF symbol resolution and relocation different from PE symbol resolution?

I've learned extensively about PE and PE64 format a while back. I am now digging deeper into ELF format. However, I've not found as many thorough resources for ELF as I did for PE, such as ARTeam's PE ...
  • 1,625
1 vote
1 answer
55 views

How are members of a Structure Type positioned on the stack?

Some of the structure types have members that are not stacked next to each other. Check out the structure type at 0x33E6 in bzip2_base (x86-64) here. There's an int at location offset 0, a char at 4 ...
  • 15
0 votes
1 answer
78 views

How is padding size calculated for members of structure types?

Looking at DWARFs of bzip2_base I see different offsets between members of a structure type although they are of the same type. Check _IO_FILE structure at the offset 0x9c here. All the way until the ...
  • 15
1 vote
1 answer
53 views

GDB exited when running library

I'm new with gdb and I have spent hours looking for direction but I can't find any. I need to analyze an executable to find how this program process the arguments and where the output came from. I ...
12 votes
1 answer
1k views

Extracting strings from Go binaries

Is there an easy way to extract all of the strings from Go binaries that will work cross architecture? The problem with Go is that strings are stored without a null terminator, so you can't use the &...
  • 221
0 votes
0 answers
156 views

Combine two ELF binaries

Without having access to the original source code, is there a way to combine two ELF binaries with the main() in the first binary pointing to the main() in the second binary ? In other words, I mean ...
  • 136
1 vote
0 answers
67 views

dwarf: variable offset from base

I have a simple code: int main() { int a = 4; printf("%d\n", a); a = 8; if (a == 8) printf("%d\n", a); return 0; } DIEs for the function and variable: <1><32a>: Abbrev ...
  • 1,477
0 votes
0 answers
265 views

Shellcode execution segfault

I have been trying to exploit simple buffer overflow caused by scanf. I'm working on x86 Linux. The point is to spawn a shell. I sucesfully overwritten return address and jumped into my shellcode. But ...

1
2 3 4 5