Questions tagged [elf]
the Executable and Linkable Format is the main executable and object format for Linux, Solaris, *BSD, and many other OSes...
239
questions
1
vote
1
answer
1k
views
Extract PYZ Error
I successfully recovered some PYC files from an ELF built by PyInstaller (https://github.com/extremecoders-re/pyinstxtractor/wiki/Extracting-Linux-ELF-binaries). There is a PYZ archive in the dump. I ...
CommunityBot
- 1
3
votes
1
answer
239
views
What is actually loaded here and different hexdump outputs on util-linux hexdump and on cutter and ghidra's hexdump
I was trying to understand what segment of file gets loaded by fourth LOAD header on phdr array.
First 6 headers are shown below from readelf
Program Headers:
Type Offset ...
CommunityBot
- 1
2
votes
0
answers
111
views
What is the ELF .got section used for?
I'm trying to learn how GOT/PLT works in ELF binaries. The way I see it - there's three sections; .got, .plt and .got.plt.
When the program tries to call an imported function which is lazy binded, it ...
- 21
1
vote
1
answer
66
views
Patching a B(ranch) causes segfault in ARMv7 binary, while the same patch (with JMP) works on x64 binary
Any ideas why trying to patch a ARMv7 binary causes a segfault while basically the same patch on the Win64 version of the software works as expected?
Here is the Win64 version, that works
UPX0:...
CommunityBot
- 1
2
votes
0
answers
33
views
Please help with striped binary reverse
Not so long ago I was engaged in reverse and pwn, I came across such a task
This is a normal task with a vulnerability on the heap, but it is striped and I don’t understand where which functions are
I ...
- 39
20
votes
2
answers
5k
views
Why are GOT and PLT still present in Linux static stripped binaries?
I am looking at statically linked linux x86 stripped binary. I noticed that there are .got and .plt sections.
I wonder what does a statically linked binary need got and plt sections for ? Anyone ?
- 10.8k
2
votes
0
answers
344
views
Shellcode execution segfault
I have been trying to exploit simple buffer overflow caused by scanf. I'm working on x86 Linux. The point is to spawn a shell. I sucesfully overwritten return address and jumped into my shellcode. But ...
2
votes
0
answers
96
views
Does AnyOne knows how to reverse python file that is encoded into elf binary .cpython-310.so extension? Please Help me Out
Following is the link to the file that I want to reverse. This is the python file that is encoded in cpython or cython and it is now a binary file.
Please help me to decode it as it is very important ...
- 225
3
votes
3
answers
3k
views
startup program exits with code 126 when executing program at entrypoint
I want to reverse engineer a program. I managed to find the entry point but every time I want to launch the application I get the same error `During startup program exited with code 126.
Here is what ...
- 11
1
vote
0
answers
74
views
Program Analysis on a Wargame Binary
I've recently took it upon myself to research more about reverse engineering, I'm currently testing my intermediate skills on various CTF hosting sites. Interestingly enough I have come across a ...
- 11
131
votes
2
answers
118k
views
What is PLT/GOT?
From time to time, when disassembling x86 binaries, I stumble on
reference to PLT and GOT, especially when calling procedures from a
dynamic library.
For example, when running a program in gdb:
(gdb)...
- 10.8k
7
votes
1
answer
901
views
Determine if an ELF file is signed or not
I need some help in determining if an ELF file is signed or with a valid signature or not.
I have used the readelf tool with -S option in order to view the section headers and more specifically, the ...
CommunityBot
- 1
2
votes
0
answers
61
views
Merge HEX file into existing ELF file in ghidra
I have an Infineon Tricore ELF file. I have a HEX file that has been patched with minor changes and new code appended (e.g. the hex from the ELF was exported and then had changes made to it manually ...
- 10.8k
3
votes
2
answers
560
views
What are these LOAD segments in an assembly ELF64?
I wrote the following (fasm) assembly program:
format ELF64 executable
segment readable executable
; sys_exit, sys_write, strlen and print are from io.inc and
; unistd64.inc at: https://github.com/...
- 10.8k
6
votes
3
answers
8k
views
How to SUCCESSFULLY add a code section to an executable file in Linux?
I am in Linux, and I have seen this question a few times but never, nobody answered how to really make this work.
I need to add a section to an already compiled binary. Lets say for a moment is an ...
- 233
2
votes
2
answers
2k
views
ptrace TRACE_PEEKER: Input/output error accessing virtual address contents when traced file is a shared object file
I'm using updated Kali and compiling this for 64- bit
Working through Learning Linux Binary Analysis,'simple ptrace-based debugger' on page 57.
Source code and testfile to debug included.
Problem ...
- 1
62
votes
7
answers
16k
views
Visualizing ELF binaries
I recently saw an older talk by Sergey Bratus and Greg Conti by the name of Voyage of the Reverser: A Visual Study of Binary Species.
Are there any opensource/free tools that one could use to see ...
- 125
1
vote
1
answer
3k
views
How to disable relro while compilation?
My doubt is how to compile the binary without RELRO? and why it is enabling FULL-RELRO when we are not providing any flags?
This is the code.
#include <stdio.h>
#include <stdlib.h>
int ...
- 117
2
votes
1
answer
139
views
How can I verify section -> segment mapping for ELFs on linux?
I'm looking at at ELF on linux and I have readelf --segments ./myELF which shows:
Program Headers:
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align
PHDR ...
- 786
3
votes
1
answer
61
views
x64 buffer overflow - tcp shell payload
ASLR: off
Canary: on
I have a binary that when run, it spawns zombie process on port 9191. I've been using ghidra and gdb to reverse engineer this and have found the buffer, canary, found the pop rdi ...
- 599
1
vote
0
answers
53
views
determine the PC of code gadgets in PLT section of ELF file
I am trying to parse an ELF file using custom code. With reference to the image below (output displayed is from objdump), I need to get the address of code gadget starting at , for example 401030 for ...
- 11
1
vote
0
answers
825
views
How can i get the address of a function in memory?
I am currently completing a CTF exercise where i must attempt to overwrite a function pointer on the stack through a buffer overflow here is the code:
#include <err.h>
#include <stdio.h>
#...
3
votes
2
answers
4k
views
Finding the library an imported function is from in IDA
I'm fairly new to reversing, and I have even less experience with IDA Pro. I am wondering if there is a way to figure out from where an imported function is imported, i.e. a memory location I can find ...
1
vote
0
answers
81
views
Intercepting a PHP module with frida
I have a PHP module, and I'm trying to hook the functions of that module.
...
39: 0000000000024a60 1858 FUNC LOCAL DEFAULT 12 zim_ClassName_ClassName_exec
...
90: 0000000000028f10 8 ...
- 166
1
vote
0
answers
74
views
how to hide all export functions in a elf so library?
I have this game I want to patch, the game server executable loads a elf so library with functions. I want to add new functions into this library so I patched the game server executable with elfpatch ...
1
vote
1
answer
361
views
Ida cannot open. a files of esp32 (Xtensa)
I tried to open this file with IDA Pro
https://github.com/espressif/esp32-wifi-lib/blob/master/esp32/libpp.a
Ida detect that is ELF for Xtensa (relocatable)
But when I tired to open it I got
Undefined ...
CommunityBot
- 1
0
votes
1
answer
189
views
Reverse engineering ELF: The e_phentsize field in the ELF header is less than the size of an ELF program header
I have extracted the .so binary libTheArmKing.so (located in lib directory in apk file) from a hack of World War Heroes game (an Android game) from Plantimod Forum.
file output:
libTheArmKing.so: ELF ...
- 786
2
votes
0
answers
51
views
Wrong EP on an .elf CrackMe
I am trying to solve an elf CrackMe. I opened it with IDA Pro and I saw start function is on address 0x1E8. I opened the elf with HxD and I saw entry point is 0x1E9 (and no results on file for 01E8)......
- 2,454
2
votes
2
answers
426
views
debugging an older version of libc
I'm trying to understand heap exploitation better. Therefore, I compiled the following file:
https://github.com/shellphish/how2heap/blob/master/glibc_2.25/fastbin_dup_into_stack.c
I have the newest ...
CommunityBot
- 1
6
votes
1
answer
1k
views
What's the format of Mediatek MRE VXP file and how to create a workable VXP binary?
Background
Mediatek's MRE (MAUI Runtime Environment) is the default runtime on Nokia S30+ platform, replacing the J2ME platform on older Nokia. From MRE's page:
MRE (MAUI Runtime Environment) is a ...
- 239
12
votes
1
answer
2k
views
Extracting strings from Go binaries
Is there an easy way to extract all of the strings from Go binaries that will work cross architecture?
The problem with Go is that strings are stored without a null terminator, so you can't use the &...
- 786
1
vote
1
answer
335
views
Figure out method name with _dl_runtime_resolve_xsavec
I have a packed Linux shared library that decrypts function stub with INIT_ARRAY.
When it's decrypted I'm unable to determine the method name. All method calls are redirected with relocation table. ...
CommunityBot
- 1
4
votes
3
answers
2k
views
How can I get the byte size of an operand in IDA Pro?
I am trying to get the byte size of all operands in a given instruction from IDA Pro. At first I tried using GetOperandValue(ea,n) to see how large the value was and calculate how many bytes were ...
- 1,518
0
votes
1
answer
813
views
Running ELF file built for ARM arhitecture
My goal is to run and debug ELF file (c444) which is compiled for the ARM architecture. I have some experience with x32 and x64 Intel architectures. However, I down know how to proceed with ARM-based ...
CommunityBot
- 1
0
votes
0
answers
466
views
Basic buffer-overflow on a remote program with Python/pwntools
I work on a online program in which I should do a buffer Overflow.
When I run the program, I have to complete a sum of two numbers generated randomly) :
>>> 451389913 + 1587598959 =
If I put ...
- 529
1
vote
0
answers
68
views
Normal artifact or something else?
I'm working on a Linux ELF challenge.
I have found this bit of code in the .text disassembly using objdump -d -M intel program
922: 83 c4 10 add esp,0x10
925: c7 45 f4 00 00 00 ...
- 2,454
10
votes
2
answers
14k
views
Which python library for parsing Linux ELF files?
I want to be able to parse 32 and 64 bit ELF files - but not create or modify them (e.g. as discussed in this thread). The ELF binaries may possibly come from embedded Linux systems, that is, the ...
- 113
0
votes
2
answers
342
views
Reversing an obfuscation through a long linear switch statement
I have a program (ELF, 32 bits) that is probably quite short and simple, but which have been obfuscated with the following construction:
i = 0
switch(i):
case 0:
one small instruction
...
CommunityBot
- 1
1
vote
0
answers
143
views
silvio packer for shared libray leads to error: "ELF load command address/offset not properly aligned"
I'm trying to implement a packer based on silvio infection. The packer works fine for ET_EXEC. However, it failed with "ELF load command address/offset not properly aligned" error for the ...
- 81
18
votes
4
answers
14k
views
How to generate the call graph of a binary file?
I have a non-stripped ELF binary for which I want to create a call graph as a dot file. Is there such a tool which generates the call graph?
EDIT: Is there away in addition to the conventional call ...
- 155
1
vote
1
answer
575
views
Disassembling Hexagon - Corrupted ELF
I downloaded and unpacked the modem from Google source, after that
I used laginimaineb's script to unify all modem binary data. However, when loading this binary to IDA, I get an error says:
Binary ...
- 1,100
1
vote
0
answers
66
views
failed to trigger packer's loader by overwritting the entry of rela.dyn on aarch64
I have implemented packer of x86_64 shared library.
Briefly, a loader is injected to a shared library, and
the rela.dyn entry is modified such that it points to the address of the loader. Once the ...
- 81
3
votes
1
answer
228
views
Code caves in arm assembly
In a disassembled elf binary i found these arm thumb instructions:
function0
0x002cc3a8 8079 ldrb r0, [r0, #6]
0x002cc3aa 7047 bx lr
In the codecave these were the initial hex ...
- 164
1
vote
1
answer
111
views
Is an ELF SHT_RELA section with a 0 `sh_link` valid?
I have an 64-bit s390x ELF binary with a RELA section named ".rela.plt" whose sh_link field is 0. I was under the impression that the sh_link is a required value, providing the id of the ...
CommunityBot
- 1
2
votes
2
answers
2k
views
How the dynamic linker determines which routine to call on Linux?
I have a question about dynamic linking on Linux. Consider the following disassembly of an ARM binary.
8300 <printf@plt-0x40>:
....
8320: e28fc600 add ip, pc, #0, 12
8324: e28cca08 ...
- 35.8k
2
votes
0
answers
142
views
How do relocations work for imported functions in SH4 ELF?
I build very simple hello world code with sh4 gcc compiler as shared library:
#include <stdio.h>
void hello()
{
printf("Hello world!\n");
}
But when I load .so file into the ...
- 1,830
0
votes
1
answer
275
views
What does this function do?
I'm trying to understand what client sends to server. I already did most of the work, but one function left. I can't understand what to do with this function and what it does. I've tried to change ...
CommunityBot
- 1
6
votes
1
answer
10k
views
How to export a working elf binary from Ghidra?
When patching a program and then using the export binary function, it turns the elf headers are corrupt.
Is there any way to work around this problem?
- 1,341
11
votes
3
answers
6k
views
What are the available libraries to statically modify ELF executables?
I would like to be able to rewrite or reorganize an ELF binary program directly from the executable format (not at compile-time).
The only library I know to do this is elfesteem (used in Miasm). But,...
- 7,018
4
votes
2
answers
5k
views
How to decompile external functions of *.so library in ELF with Ghidra?
There are some *.so libraries in my ELF file.
I can see the *.so names in "Imports" directory of "Symbol Tree" Window in Ghidra tool.
I think there are some external functions in ...
- 1,341