Skip to main content

Questions tagged [elf]

the Executable and Linkable Format is the main executable and object format for Linux, Solaris, *BSD, and many other OSes...

46 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4 votes
0 answers
342 views

Modern equivalent to rsymtab for reconstructing symbol table for statically linked / stripped binaries?

I'm working with a 32-bit ELF binary that (I believe) has been statically linked against a few different third-party libraries. It has also been stripped, so I don't have much to go on with respect to ...
Colin's user avatar
  • 91
2 votes
0 answers
39 views

Please help with striped binary reverse

Not so long ago I was engaged in reverse and pwn, I came across such a task This is a normal task with a vulnerability on the heap, but it is striped and I don’t understand where which functions are I ...
K05t1K_RWX's user avatar
2 votes
0 answers
165 views

Does AnyOne knows how to reverse python file that is encoded into elf binary .cpython-310.so extension? Please Help me Out

Following is the link to the file that I want to reverse. This is the python file that is encoded in cpython or cython and it is now a binary file. Please help me to decode it as it is very important ...
Jameel Safdar's user avatar
2 votes
0 answers
111 views

Merge HEX file into existing ELF file in ghidra

I have an Infineon Tricore ELF file. I have a HEX file that has been patched with minor changes and new code appended (e.g. the hex from the ELF was exported and then had changes made to it manually ...
rollsch's user avatar
  • 263
2 votes
0 answers
68 views

Wrong EP on an .elf CrackMe

I am trying to solve an elf CrackMe. I opened it with IDA Pro and I saw start function is on address 0x1E8. I opened the elf with HxD and I saw entry point is 0x1E9 (and no results on file for 01E8)......
pericopo10's user avatar
2 votes
0 answers
184 views

How do relocations work for imported functions in SH4 ELF?

I build very simple hello world code with sh4 gcc compiler as shared library: #include <stdio.h> void hello() { printf("Hello world!\n"); } But when I load .so file into the ...
Anton Kukoba's user avatar
  • 1,850
2 votes
0 answers
672 views

Tool/parser for symbol tables produced with objdump -t to be used with IDA / Ghidra?

Working with a binary (arm64) file that seems to be some sort of a broken ELF file. The header data is missing and for some reason it contains a symbol table in a format that to me seem to be equal to ...
blubbafett's user avatar
2 votes
0 answers
407 views

Shellcode execution segfault

I have been trying to exploit simple buffer overflow caused by scanf. I'm working on x86 Linux. The point is to spawn a shell. I sucesfully overwritten return address and jumped into my shellcode. But ...
user32914's user avatar
2 votes
0 answers
2k views

Debugging a position independent executable ELF

I am trying to follow the write-up about hackercalc (a challenge for DEFCON 2015 quals). First, by loading the challenge into gdb, I observe that: (gdb) info files ... Entry point: 0xcf8 ... So I ...
Ta Thanh Dinh's user avatar
2 votes
0 answers
612 views

Trying to run MIPS ELF with a cross toolchain but sigbus error

I finally successfuly installed a cross toolchain from this site in order to run and debug a mips elf on my x86-64 . I only have the elf file. I can disassemble it but when i try to run it with : ...
creuchmeuch's user avatar
2 votes
0 answers
555 views

Patch ELF (arm): remove constructor segment

I got an ELF shared library with a constructor function that is executed every time the library is loaded: .init_array:00005E5C ; ===================================================================== ...
Krypton's user avatar
  • 191
2 votes
1 answer
667 views

Debugging Binary using Far Ret to switch Code Segment

It appears that GDB is unable to handle binaries which switch code segments. Using pwntools*, it's trivial to generate a 32-bit intel binary which uses retf to switch to the 64-bit code segment. ...
Zach Riggle's user avatar
  • 2,357
1 vote
1 answer
64 views

Inject ELF with an entierly self-contained code section that can statically call standard library functions

What I want to do What I want to do is inject an existing ELF binary with additional code that runs before the original .text section and then transfers control back to it. What I can already do Now, ...
PaperTsar's user avatar
  • 111
1 vote
0 answers
56 views

Default linker files and sections: Explain thier origin/history and thier purpose

I have a Linux Ubuntu(20.04) machine with gcc and clang installed. I figured out the directory containing the default linker script: /usr/lib/x86_64-linux-gnu/ldscripts$ ls elf32_x86_64.x ...
Self's user avatar
  • 11
1 vote
0 answers
92 views

Program Analysis on a Wargame Binary

I've recently took it upon myself to research more about reverse engineering, I'm currently testing my intermediate skills on various CTF hosting sites. Interestingly enough I have come across a ...
Gregory's user avatar
  • 11
1 vote
0 answers
92 views

determine the PC of code gadgets in PLT section of ELF file

I am trying to parse an ELF file using custom code. With reference to the image below (output displayed is from objdump), I need to get the address of code gadget starting at , for example 401030 for ...
Mahwish's user avatar
  • 11
1 vote
0 answers
2k views

How can i get the address of a function in memory?

I am currently completing a CTF exercise where i must attempt to overwrite a function pointer on the stack through a buffer overflow here is the code: #include <err.h> #include <stdio.h> #...
professional pro's user avatar
1 vote
0 answers
171 views

Intercepting a PHP module with frida

I have a PHP module, and I'm trying to hook the functions of that module. ... 39: 0000000000024a60 1858 FUNC LOCAL DEFAULT 12 zim_ClassName_ClassName_exec ... 90: 0000000000028f10 8 ...
Cagri's user avatar
  • 176
1 vote
0 answers
122 views

how to hide all export functions in a elf so library?

I have this game I want to patch, the game server executable loads a elf so library with functions. I want to add new functions into this library so I patched the game server executable with elfpatch ...
Alvaro Hernandorena's user avatar
1 vote
0 answers
83 views

Normal artifact or something else?

I'm working on a Linux ELF challenge. I have found this bit of code in the .text disassembly using objdump -d -M intel program 922: 83 c4 10 add esp,0x10 925: c7 45 f4 00 00 00 ...
Mr. Kelsey's user avatar
1 vote
0 answers
178 views

silvio packer for shared libray leads to error: "ELF load command address/offset not properly aligned"

I'm trying to implement a packer based on silvio infection. The packer works fine for ET_EXEC. However, it failed with "ELF load command address/offset not properly aligned" error for the ...
prgbenz's user avatar
  • 81
1 vote
0 answers
71 views

failed to trigger packer's loader by overwritting the entry of rela.dyn on aarch64

I have implemented packer of x86_64 shared library. Briefly, a loader is injected to a shared library, and the rela.dyn entry is modified such that it points to the address of the loader. Once the ...
prgbenz's user avatar
  • 81
1 vote
0 answers
313 views

Dynamic Analysis with gdb on ELF binaries with no compilation/linking information

I am trying to do some dynamic analysis on a couple of ELF binaries with gdb. However, since those two are directly downloaded (ELF binary file only) with no additional information related to ...
eda's user avatar
  • 11
1 vote
1 answer
2k views

Extract PYZ Error

I successfully recovered some PYC files from an ELF built by PyInstaller (https://github.com/extremecoders-re/pyinstxtractor/wiki/Extracting-Linux-ELF-binaries). There is a PYZ archive in the dump. I ...
armor's user avatar
  • 119
1 vote
0 answers
133 views

Statically injecting translated NASM assembly into existing ELF binary

I'm trying to statically patching ELF binaries in order to incorporate code that can help provide run-time protection. In an effort to save time writing and debugging assembly, I took the following no-...
alcao758's user avatar
  • 111
1 vote
0 answers
145 views

dwarf: variable offset from base

I have a simple code: int main() { int a = 4; printf("%d\n", a); a = 8; if (a == 8) printf("%d\n", a); return 0; } DIEs for the function and variable: <1><32a>: Abbrev ...
R4444's user avatar
  • 1,807
1 vote
0 answers
2k views

Finding function call (with arguments) in ELF file

I have two kinds of ELF files, built from C++. .so files: ELF 64-bit LSB shared object, x86-64, version 1 (GNU/Linux), dynamically linked, BuildID[sha1]=5e751e769912aef28bc63b888e5e4904b867a180, ...
afsantos's user avatar
  • 111
1 vote
0 answers
236 views

Need help understanding basic buffer overflow

So I have this sample problem that I need to buffer overflow. Its an elf file that require to be run on a separate terminal then using "nc localhost 'port' " on a separate terminal we can see the ...
Omar Elgafri's user avatar
1 vote
0 answers
47 views

Legal Reverse Engineering for Security Review in US for Korean Provided Module

My company has received a command-line stand-alone (ELF) executable from a Korean company that provides a service for validating Korean users. It took them a few tries to get us a version that runs on ...
NathanC's user avatar
  • 19
1 vote
0 answers
202 views

Are there tools or plugins for IDA Pro that can find ELF sections?

I'm trying to use data from one ELF to build another ELF, but I can't seem to find anything that gets what I need using IDA Pro. I'm trying to build a database out of Sections, Symbols, and Cross-...
theTheodidact's user avatar
1 vote
0 answers
487 views

ELF .text infection test

I'm trying to implement an example of an ELF .text infection as described in "Learning Linux Binary Analysis". I'm currently having a problem where I successfully injected my data into the .text ...
Andrew's user avatar
  • 11
1 vote
0 answers
2k views

My core dump's backtrace stops to a signal handler, what can I do?

I obtained an ELF core dump that was provoked by fuzzing a proprietary server. As I do not have access anymore to the machine that hosted this server, and the server is part of a tightly coupled set ...
Cécile Bertau's user avatar
1 vote
0 answers
402 views

Accessing .rodata/.rel.data.ro

Analyzing an android ELF binary. How/where does something access a specific area of .rodata or .rel.data.ro? Have tried using objdump, rabin2, readelf, etc and I can't seem to figure out how it is ...
Craig's user avatar
  • 11
1 vote
0 answers
717 views

Elf binary manipulation tool on ARM

Do you know any free tool for binary manipulation elf file on ARM, something like ERESI elfsh for Intel? Purpose - adding instructions into existing binary elf file.
Ryszard Grzesica's user avatar
1 vote
0 answers
131 views

Packers that partially decrypts contents on-the-fly

I'm on the lookout for packers that I could use/read the source for, that don't decrypt the contents of the original binary in one go and jump to it. Do you know of any packer that decodes/decrypts a ...
user avatar
1 vote
0 answers
635 views

Define new code section in assembly code to compile ELF binary

I defined a new code section in my assembly program, which is going to be compiled into 32-bit ELF binary, on x86. I use the linker scripts to assign a specified address for this new code section, it ...
lllllllllllll's user avatar
1 vote
0 answers
2k views

How to change the export function name of android so file (ELF format)

Here are my .so files: libJlcVideoEncoder.so java_so_change.exe Below are export functions inside .so files: Java_com_jlc_BubbleChat_libJlcVideoEncoder_JNIJlcInit ...
cute_star's user avatar
0 votes
0 answers
58 views

Improving the output of pseudocode C++ code from IDA Pro

I have some specific questions and some general ones about reverse-engineering a dynamic shared library via IDA Pro 8.3: If I know the compiler used and compiler flags used (via readelf --debug-dump),...
HCSF's user avatar
  • 143
0 votes
0 answers
47 views

Why is an empty binary larger than one with a variable?

On my own self-learning R.E. Starting with understanding ELF and hopefully whats going on with every byte. I build 2 simple binaries: 1 with a variable and 1 without. For some reason, the one without ...
EraserPencil's user avatar
0 votes
0 answers
57 views

Attempting to auto reverse XOR

Does anyone know of any helpful tools or a way to automate decryption of XOR in IDA? I know that they have a built in function to do some bare XOR encryption but this one seems a bit more ...
Babyhamsta's user avatar
0 votes
1 answer
416 views

Adding a program header to ELF

I am a newbie in this, and I am trying to add a program header to a simple ELF64 "Hello World" program on Ubuntu. All in changing the binary data of the ELF. I went to the end of the program ...
Roy Avidan's user avatar
0 votes
1 answer
84 views

What ELF `e_flags` are defined for TI MSP430(X)

I have an MSP430 ELF executable file whose e_flags field is 0x0000000E. I cannot find any documentation for e_flags for this architecture. The application note "MSP430 Embedded Application Binary ...
John Källén's user avatar
0 votes
0 answers
728 views

Basic buffer-overflow on a remote program with Python/pwntools

I work on a online program in which I should do a buffer Overflow. When I run the program, I have to complete a sum of two numbers generated randomly) : >>> 451389913 + 1587598959 = If I put ...
Julien's user avatar
  • 101
0 votes
0 answers
1k views

Modify Strings in a ELF (Executable and Linking Format) that are stored in the .rodata

I have 2 ELF files here, each containing strings in the ".rodata" for an translation that I want to modify. The first ELF "(binary1)" I have already successfully modified from ...
Alonia's user avatar
  • 83
0 votes
0 answers
171 views

How is ELF symbol resolution and relocation different from PE symbol resolution?

I've learned extensively about PE and PE64 format a while back. I am now digging deeper into ELF format. However, I've not found as many thorough resources for ELF as I did for PE, such as ARTeam's PE ...
the_endian's user avatar
  • 1,870
0 votes
0 answers
610 views

Combine two ELF binaries

Without having access to the original source code, is there a way to combine two ELF binaries with the main() in the first binary pointing to the main() in the second binary ? In other words, I mean ...
kevin's user avatar
  • 156