Skip to main content

Questions tagged [elf]

the Executable and Linkable Format is the main executable and object format for Linux, Solaris, *BSD, and many other OSes...

Filter by
Sorted by
Tagged with
0 votes
1 answer
92 views

What ELF `e_flags` are defined for TI MSP430(X)

I have an MSP430 ELF executable file whose e_flags field is 0x0000000E. I cannot find any documentation for e_flags for this architecture. The application note "MSP430 Embedded Application Binary ...
1 vote
1 answer
428 views

Adding a program header to ELF

I am a newbie in this, and I am trying to add a program header to a simple ELF64 "Hello World" program on Ubuntu. All in changing the binary data of the ELF. I went to the end of the program ...
0 votes
2 answers
72 views

reduce size of executable ELF program

I'm experimenting on patching my hello world program in order to make it smol. I started by reducing the size of the program with the following commands: as --32 ./hello_32.S -o ./hello_32.o ld -...
1 vote
1 answer
103 views

Tips for reverse engineering Common Lisp (SBCL) ELF binary

I got to the task of reverse engineering the ELF binary. I found out that it is a compiled SBCL. I have no idea how to do static or dynamic analysis, any tips (where to start, I found basically ...
1 vote
1 answer
68 views

Inject ELF with an entierly self-contained code section that can statically call standard library functions

What I want to do What I want to do is inject an existing ELF binary with additional code that runs before the original .text section and then transfers control back to it. What I can already do Now, ...
1 vote
1 answer
2k views

Extract PYZ Error

I successfully recovered some PYC files from an ELF built by PyInstaller (https://github.com/extremecoders-re/pyinstxtractor/wiki/Extracting-Linux-ELF-binaries). There is a PYZ archive in the dump. I ...
0 votes
0 answers
58 views

Improving the output of pseudocode C++ code from IDA Pro

I have some specific questions and some general ones about reverse-engineering a dynamic shared library via IDA Pro 8.3: If I know the compiler used and compiler flags used (via readelf --debug-dump),...
1 vote
2 answers
586 views

Adding debug symbols with GDB

In CTFs when I'm given some ELF file, it usually wasn't compiled with the -g flag. Is there a way to to somehow edit the file to make it be as if the ELF file was originally compiled with the -g flag? ...
0 votes
0 answers
47 views

Why is an empty binary larger than one with a variable?

On my own self-learning R.E. Starting with understanding ELF and hopefully whats going on with every byte. I build 2 simple binaries: 1 with a variable and 1 without. For some reason, the one without ...
0 votes
0 answers
57 views

Attempting to auto reverse XOR

Does anyone know of any helpful tools or a way to automate decryption of XOR in IDA? I know that they have a built in function to do some bare XOR encryption but this one seems a bit more ...
1 vote
1 answer
105 views

Where is IDA getting this symbol?

I'm currently researching how a certain malware works and patches some stuff in a certain Android's library. Inspecting the library -which is stripped- in IDA I was able to get the symbol for a ...
0 votes
1 answer
72 views

Updating legacy library in an already compiled binary

I'm dealing with a reverse engineering challenge involving a binary application that was statically compiled with a legacy library. While the legacy library is not vulnerable, it lacks certain ...
1 vote
0 answers
56 views

Default linker files and sections: Explain thier origin/history and thier purpose

I have a Linux Ubuntu(20.04) machine with gcc and clang installed. I figured out the directory containing the default linker script: /usr/lib/x86_64-linux-gnu/ldscripts$ ls elf32_x86_64.x ...
0 votes
1 answer
101 views

ELF - Why does objdump provide a wrong byte value in the .got?

I seriously can't tell if I'm misunderstanding something grossly or if this is a bug in objdump. Newbie alert. $ objdump -s --start-address=0x3fc0 --stop-address=0x3fc1 test test: file format ...
4 votes
3 answers
2k views

How can I get the byte size of an operand in IDA Pro?

I am trying to get the byte size of all operands in a given instruction from IDA Pro. At first I tried using GetOperandValue(ea,n) to see how large the value was and calculate how many bytes were ...
3 votes
1 answer
417 views

What is the ELF .got section used for?

I'm trying to learn how GOT/PLT works in ELF binaries. The way I see it - there's three sections; .got, .plt and .got.plt. When the program tries to call an imported function which is lazy binded, it ...
1 vote
1 answer
168 views

Is an ELF SHT_RELA section with a 0 `sh_link` valid?

I have an 64-bit s390x ELF binary with a RELA section named ".rela.plt" whose sh_link field is 0. I was under the impression that the sh_link is a required value, providing the id of the ...
13 votes
1 answer
3k views

Extracting strings from Go binaries

Is there an easy way to extract all of the strings from Go binaries that will work cross architecture? The problem with Go is that strings are stored without a null terminator, so you can't use the &...
3 votes
1 answer
257 views

What is actually loaded here and different hexdump outputs on util-linux hexdump and on cutter and ghidra's hexdump

I was trying to understand what segment of file gets loaded by fourth LOAD header on phdr array. First 6 headers are shown below from readelf Program Headers: Type Offset ...
1 vote
1 answer
73 views

Patching a B(ranch) causes segfault in ARMv7 binary, while the same patch (with JMP) works on x64 binary

Any ideas why trying to patch a ARMv7 binary causes a segfault while basically the same patch on the Win64 version of the software works as expected? Here is the Win64 version, that works UPX0:...
2 votes
0 answers
39 views

Please help with striped binary reverse

Not so long ago I was engaged in reverse and pwn, I came across such a task This is a normal task with a vulnerability on the heap, but it is striped and I don’t understand where which functions are I ...
20 votes
2 answers
6k views

Why are GOT and PLT still present in Linux static stripped binaries?

I am looking at statically linked linux x86 stripped binary. I noticed that there are .got and .plt sections. I wonder what does a statically linked binary need got and plt sections for ? Anyone ?
2 votes
0 answers
407 views

Shellcode execution segfault

I have been trying to exploit simple buffer overflow caused by scanf. I'm working on x86 Linux. The point is to spawn a shell. I sucesfully overwritten return address and jumped into my shellcode. But ...
2 votes
0 answers
165 views

Does AnyOne knows how to reverse python file that is encoded into elf binary .cpython-310.so extension? Please Help me Out

Following is the link to the file that I want to reverse. This is the python file that is encoded in cpython or cython and it is now a binary file. Please help me to decode it as it is very important ...
3 votes
3 answers
5k views

startup program exits with code 126 when executing program at entrypoint

I want to reverse engineer a program. I managed to find the entry point but every time I want to launch the application I get the same error `During startup program exited with code 126. Here is what ...
1 vote
0 answers
92 views

Program Analysis on a Wargame Binary

I've recently took it upon myself to research more about reverse engineering, I'm currently testing my intermediate skills on various CTF hosting sites. Interestingly enough I have come across a ...
142 votes
2 answers
130k views

What is PLT/GOT?

From time to time, when disassembling x86 binaries, I stumble on reference to PLT and GOT, especially when calling procedures from a dynamic library. For example, when running a program in gdb: (gdb)...
7 votes
1 answer
1k views

Determine if an ELF file is signed or not

I need some help in determining if an ELF file is signed or with a valid signature or not. I have used the readelf tool with -S option in order to view the section headers and more specifically, the ...
2 votes
0 answers
111 views

Merge HEX file into existing ELF file in ghidra

I have an Infineon Tricore ELF file. I have a HEX file that has been patched with minor changes and new code appended (e.g. the hex from the ELF was exported and then had changes made to it manually ...
3 votes
2 answers
824 views

What are these LOAD segments in an assembly ELF64?

I wrote the following (fasm) assembly program: format ELF64 executable segment readable executable ; sys_exit, sys_write, strlen and print are from io.inc and ; unistd64.inc at: https://github.com/...
6 votes
3 answers
9k views

How to SUCCESSFULLY add a code section to an executable file in Linux?

I am in Linux, and I have seen this question a few times but never, nobody answered how to really make this work. I need to add a section to an already compiled binary. Lets say for a moment is an ...
2 votes
2 answers
2k views

ptrace TRACE_PEEKER: Input/output error accessing virtual address contents when traced file is a shared object file

I'm using updated Kali and compiling this for 64- bit Working through Learning Linux Binary Analysis,'simple ptrace-based debugger' on page 57. Source code and testfile to debug included. Problem ...
62 votes
7 answers
17k views

Visualizing ELF binaries

I recently saw an older talk by Sergey Bratus and Greg Conti by the name of Voyage of the Reverser: A Visual Study of Binary Species. Are there any opensource/free tools that one could use to see ...
2 votes
1 answer
4k views

How to disable relro while compilation?

My doubt is how to compile the binary without RELRO? and why it is enabling FULL-RELRO when we are not providing any flags? This is the code. #include <stdio.h> #include <stdlib.h> int ...
3 votes
1 answer
383 views

How can I verify section -> segment mapping for ELFs on linux?

I'm looking at at ELF on linux and I have readelf --segments ./myELF which shows: Program Headers: Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align PHDR ...
3 votes
1 answer
95 views

x64 buffer overflow - tcp shell payload

ASLR: off Canary: on I have a binary that when run, it spawns zombie process on port 9191. I've been using ghidra and gdb to reverse engineer this and have found the buffer, canary, found the pop rdi ...
1 vote
0 answers
92 views

determine the PC of code gadgets in PLT section of ELF file

I am trying to parse an ELF file using custom code. With reference to the image below (output displayed is from objdump), I need to get the address of code gadget starting at , for example 401030 for ...
1 vote
0 answers
2k views

How can i get the address of a function in memory?

I am currently completing a CTF exercise where i must attempt to overwrite a function pointer on the stack through a buffer overflow here is the code: #include <err.h> #include <stdio.h> #...
3 votes
2 answers
4k views

Finding the library an imported function is from in IDA

I'm fairly new to reversing, and I have even less experience with IDA Pro. I am wondering if there is a way to figure out from where an imported function is imported, i.e. a memory location I can find ...
1 vote
0 answers
171 views

Intercepting a PHP module with frida

I have a PHP module, and I'm trying to hook the functions of that module. ... 39: 0000000000024a60 1858 FUNC LOCAL DEFAULT 12 zim_ClassName_ClassName_exec ... 90: 0000000000028f10 8 ...
1 vote
0 answers
123 views

how to hide all export functions in a elf so library?

I have this game I want to patch, the game server executable loads a elf so library with functions. I want to add new functions into this library so I patched the game server executable with elfpatch ...
1 vote
1 answer
611 views

Ida cannot open. a files of esp32 (Xtensa)

I tried to open this file with IDA Pro https://github.com/espressif/esp32-wifi-lib/blob/master/esp32/libpp.a Ida detect that is ELF for Xtensa (relocatable) But when I tired to open it I got Undefined ...
0 votes
1 answer
398 views

Reverse engineering ELF: The e_phentsize field in the ELF header is less than the size of an ELF program header

I have extracted the .so binary libTheArmKing.so (located in lib directory in apk file) from a hack of World War Heroes game (an Android game) from Plantimod Forum. file output: libTheArmKing.so: ELF ...
2 votes
0 answers
68 views

Wrong EP on an .elf CrackMe

I am trying to solve an elf CrackMe. I opened it with IDA Pro and I saw start function is on address 0x1E8. I opened the elf with HxD and I saw entry point is 0x1E9 (and no results on file for 01E8)......
2 votes
2 answers
678 views

debugging an older version of libc

I'm trying to understand heap exploitation better. Therefore, I compiled the following file: https://github.com/shellphish/how2heap/blob/master/glibc_2.25/fastbin_dup_into_stack.c I have the newest ...
6 votes
1 answer
3k views

What's the format of Mediatek MRE VXP file and how to create a workable VXP binary?

Background Mediatek's MRE (MAUI Runtime Environment) is the default runtime on Nokia S30+ platform, replacing the J2ME platform on older Nokia. From MRE's page: MRE (MAUI Runtime Environment) is a ...
1 vote
1 answer
610 views

Figure out method name with _dl_runtime_resolve_xsavec

I have a packed Linux shared library that decrypts function stub with INIT_ARRAY. When it's decrypted I'm unable to determine the method name. All method calls are redirected with relocation table. ...
0 votes
1 answer
2k views

Running ELF file built for ARM arhitecture

My goal is to run and debug ELF file (c444) which is compiled for the ARM architecture. I have some experience with x32 and x64 Intel architectures. However, I down know how to proceed with ARM-based ...
0 votes
0 answers
730 views

Basic buffer-overflow on a remote program with Python/pwntools

I work on a online program in which I should do a buffer Overflow. When I run the program, I have to complete a sum of two numbers generated randomly) : >>> 451389913 + 1587598959 = If I put ...
1 vote
0 answers
83 views

Normal artifact or something else?

I'm working on a Linux ELF challenge. I have found this bit of code in the .text disassembly using objdump -d -M intel program 922: 83 c4 10 add esp,0x10 925: c7 45 f4 00 00 00 ...

1
2 3 4 5 6