Questions tagged [elf]
the Executable and Linkable Format is the main executable and object format for Linux, Solaris, *BSD, and many other OSes...
239
questions
131
votes
2
answers
118k
views
What is PLT/GOT?
From time to time, when disassembling x86 binaries, I stumble on
reference to PLT and GOT, especially when calling procedures from a
dynamic library.
For example, when running a program in gdb:
(gdb)...
- 18.7k
62
votes
7
answers
16k
views
Visualizing ELF binaries
I recently saw an older talk by Sergey Bratus and Greg Conti by the name of Voyage of the Reverser: A Visual Study of Binary Species.
Are there any opensource/free tools that one could use to see ...
user1743
30
votes
4
answers
42k
views
Cross debugging for ARM / MIPS ELF with QEMU/toolchain
as i'm new about cross-debugging and cross-compilation i need some help because i feel so confused. I have a MIPS elf file, [myelf][1] .You can see bellow the output of file myelf:
myelf: ELF 32-bit ...
- 475
29
votes
1
answer
26k
views
What symbol tables stay after a strip In ELF format?
I am currently looking at the ELF format, and especially at stripped ELF executable program files.
I know that, when stripped, the symbol table is removed, but some information are always needed to ...
- 18.7k
28
votes
1
answer
103k
views
Reversing ELF 64-bit LSB executable, x86-64 ,gdb
I'm a newbie and just got into RE.
I got a ELF 64-bit LSB executable, x86-64. I'm trying to reverse it.
First I tried to set a break point on line 1 using
gdb ./filename
break 1
The gdb says
No ...
- 433
20
votes
2
answers
5k
views
Why are GOT and PLT still present in Linux static stripped binaries?
I am looking at statically linked linux x86 stripped binary. I noticed that there are .got and .plt sections.
I wonder what does a statically linked binary need got and plt sections for ? Anyone ?
- 603
19
votes
4
answers
24k
views
Set a breakpoint on GDB entry point for stripped PIE binaries without disabling ASLR
Given a position-independent, statically-linked, stripped binary, there does not appear to be a way in GDB to set a breakpoint at the entry point without disabling ASLR.
break start and similar ...
- 2,307
18
votes
4
answers
14k
views
How to generate the call graph of a binary file?
I have a non-stripped ELF binary for which I want to create a call graph as a dot file. Is there such a tool which generates the call graph?
EDIT: Is there away in addition to the conventional call ...
- 657
12
votes
2
answers
13k
views
Why I can not directly get the content of `.bss` section?
Test is on Linux 32bit.
I use this command to get the context of .text .rodata and .data section:
objdump -s -j .text elf_binary
objdump -s -j .rodata elf_binary
objdump -s -j .data elf_binary
But ...
- 2,465
12
votes
1
answer
5k
views
How are stripped shared libraries linked against?
Lately I've been reversing the Android framework for the Nexus S mobile phone.
99% of the source code is of course open, but there are few propriety shared libraries which needs to be downloaded in ...
- 4,755
12
votes
1
answer
2k
views
Extracting strings from Go binaries
Is there an easy way to extract all of the strings from Go binaries that will work cross architecture?
The problem with Go is that strings are stored without a null terminator, so you can't use the &...
- 221
11
votes
4
answers
8k
views
How can I generate a call graph from an unstripped x86 Linux ELF?
There's a piece of software, for which I only have the binary, not the source code. It's:
unobfuscated (so, not polymorphic or anything. It is optimized a bit, though)
unstripped
x86 32 bit
...
- 281
11
votes
3
answers
6k
views
What are the available libraries to statically modify ELF executables?
I would like to be able to rewrite or reorganize an ELF binary program directly from the executable format (not at compile-time).
The only library I know to do this is elfesteem (used in Miasm). But,...
- 18.7k
10
votes
2
answers
3k
views
Fixing the checksum of a modified Android ELF
I've hex-edited a string in an Android ELF binary.
Now, it won't run, and gives the error message CANNOT LINK EXECUTABLE, presumably due to a bad checksum.
Does anybody have a tool to fix the ...
- 181
10
votes
2
answers
14k
views
Which python library for parsing Linux ELF files?
I want to be able to parse 32 and 64 bit ELF files - but not create or modify them (e.g. as discussed in this thread). The ELF binaries may possibly come from embedded Linux systems, that is, the ...
- 1,518
9
votes
2
answers
14k
views
What is a good and reliable C decompiler that support ELF and SH4 Architecture?
I have a ELF file, which is a partial firmware of a navigation module(my BMW idrive CCC), I need to decompile the elf file.
I tried Reko Decompiler which said it does not support SH4 and Snowman ...
- 229
8
votes
2
answers
941
views
Reassembling ELF binary files
I have been doing a number of CTF activities when I came across something I’m unfamiliar with. As I am somewhat new to exploitation and reverse engineering, this was unfamiliar to me.
I have 7 pieces ...
- 81
7
votes
2
answers
3k
views
Writing ELF headers in Radare?
Reading Keith Makan's, "Introduction to the ELF Format : The ELF Header", he modifies e_entry,
The e_entry field lists the offset in the file where the program should start executing.Normally it ...
- 1,724
7
votes
2
answers
4k
views
How to recover information stored in .ctors section?
Test is on x86, 32-bit Linux. I am using g++ 4.6.3 and objdump 2.22
Here is a simple C++ code I am working on:
#include <iostream>
using namespace std;
main()
{
cout << "Hello ...
- 2,465
7
votes
3
answers
6k
views
No dynamic symbol table but resolution of method from shared libraries is working
I want to find how can I identify calls to shared libraries in GDB only. On a stripped binary, I cannot found the dynamic symbol table:
$> objdump -tT crackme-01
crackme-01: file format elf32-...
- 173
7
votes
1
answer
2k
views
Understanding gdb output
So I was messing with gdb and came across something rather interesting. I ran the following code into gdb:
int i, g = 1;
for (i = 0; i < 100; i++)
g++;
Before execution, disas main ...
- 397
7
votes
2
answers
13k
views
Fixing corrupt ELF header field "e_shnum" for use in GDB
If the ELF header which usually can be read using readelf has been manually manipulated, let's say by increasing the value for the "Size of section headers" the binary still can be executed and works ...
- 125
7
votes
1
answer
901
views
Determine if an ELF file is signed or not
I need some help in determining if an ELF file is signed or with a valid signature or not.
I have used the readelf tool with -S option in order to view the section headers and more specifically, the ...
- 71
6
votes
3
answers
2k
views
Elf x86_64 adding function
I'm trying to see if I can append function code in the .text section of an ELF while still maintaining the execution flow of the original ELF. Ideally, I want to call the new function but that's it's ...
- 63
6
votes
3
answers
11k
views
Packers/Protectors for Linux
I was wondering if anyone had come across a packer/protector which could be used for ELF binaries. There seem to be quite a few articles on writing packers and protectors for the PE format -- however, ...
user1743
6
votes
1
answer
4k
views
Why have two symbols tables?
Why have two symbol tables if .symtab already contains everything that's in .dynsym ?
- 85
6
votes
1
answer
10k
views
How to export a working elf binary from Ghidra?
When patching a program and then using the export binary function, it turns the elf headers are corrupt.
Is there any way to work around this problem?
- 61
6
votes
3
answers
8k
views
How to SUCCESSFULLY add a code section to an executable file in Linux?
I am in Linux, and I have seen this question a few times but never, nobody answered how to really make this work.
I need to add a section to an already compiled binary. Lets say for a moment is an ...
- 233
6
votes
2
answers
5k
views
IDA Load Symbols From Static Library
I have a stripped elf file that has statically linked libraries. Is there a way that I could take the original library files that are in a files and name the functions in IDA that match those in the ...
- 171
6
votes
1
answer
1k
views
What's the format of Mediatek MRE VXP file and how to create a workable VXP binary?
Background
Mediatek's MRE (MAUI Runtime Environment) is the default runtime on Nokia S30+ platform, replacing the J2ME platform on older Nokia. From MRE's page:
MRE (MAUI Runtime Environment) is a ...
- 239
5
votes
1
answer
5k
views
Why ther are some many padding/leading nop instructions in my binary code?
The test platform is on Linux 32bit, x86.
So basically I wrote a simple C program like this:
void main()
{
double a = 10.0;
printf("hello world %f\n", a);
}
I use gcc to compile to ...
- 2,465
5
votes
2
answers
3k
views
Meaning of Flags in ELF Section header?
Given this classic helloworld.c example,
#include <stdio.h>
int main() {
printf("Hello world!\n");
}
In below sections output, the value for Flags presents a couple of different values, e....
- 85
5
votes
1
answer
2k
views
Find function in a stripped dynamic ELF library
Im currently reverse engineering an android app and this app calls a function named "getUserInfo" in an ARM 32bit ELF library called "libcms.so" (from TikTok) via the Java Native Interface.
My ...
- 153
5
votes
2
answers
15k
views
Decoding the UPX ELF header file
Still on my way to understand how to prevent the usage of the -d (decompress) option of UPX (see this question), I try to identify the header file of UPX in ELF executable files.
Looking at the code, ...
- 18.7k
5
votes
2
answers
20k
views
Find base address and memory size of program debugged in gdb
I want to find out the base address and the imagesize of the program being debugged in gdb. As in, where it got loaded in memory. For shared libraries I can do "info sharedlibrary" and I get very ...
- 423
5
votes
1
answer
5k
views
Why are symbols with local binding present in the symbol table of my ELF files?
I found out that there are symbols with binding=LOCAL and visibility=HIDDEN in the symbol table (.symtab) of ELF executables/libraries. What are they needed for? They are not involved in the ...
- 51
5
votes
1
answer
358
views
Importance of Compiler Version in generating a signature
I load a reference elf that I cross-compiled for AArch64 into IDA Pro, idb2pat to generate a .pat which I then process through sigmake.
I then use the signature file (in the appropriate IDA Pro ...
- 173
5
votes
1
answer
865
views
Difference between 'readelf' and 'radare2' addresses
I have an MIPS binary file that I want to analyze. I am having a little trouble understanding the way elfread and r2 interpret the adressing scheme from a binary.
For example, r2 finds a function ...
- 53
5
votes
1
answer
1k
views
Associating Symbol Names with .PLT Entries
Doing some messing around with ELF (of both the x86 and ARM varieties).
Associating symbol names with entries in the .got section is straightforward. Find the .got section, find the relocation ...
- 2,307
5
votes
1
answer
5k
views
How to create a IDA FLIRT signature for a PPC library?
I'd like to create a IDA FLIRT signature for the following PPC uClibc library:
libuClibc-0.9.15.so: ELF 32-bit MSB shared object, PowerPC or cisco 4500, version 1 (SYSV), dynamically linked, for GNU/...
- 227
5
votes
1
answer
2k
views
Merging elf shared-objects
Let say I have libA.so and libB.so, is there any way for me to combine them into a single shared library libC.so that contains all exported symbols of both libA.so and libB.so?
- 191
4
votes
6
answers
10k
views
How to match disassembled instructions back to C/C++ source?
Basically here's what I want to know, if you have a disassembled instruction say:
jz 0x8048e1a
And, you also have the source code. How do you go about figuring out what this instruction relates to ...
- 191
4
votes
4
answers
1k
views
Is it possible to (heuristic) identify the begin addr of main function in a stripped ELF?
So basically I am working on some tripped dynamic linked ELF binaries (32 bit Linux x86), using objdump to disassemble them, modifying and trying to reassemble them.
In the unstripped binary, we can ...
- 2,465
4
votes
2
answers
789
views
Struct reconstruction in decompilers
I'm testing several decompilers about struct reconstruction, given the following C example:
struct S {
int x;
int y;
long z;
long t;
};
int foo(struct S s) {
return s.x + s.y + s....
- 1,410
4
votes
3
answers
9k
views
Start analysis at any position in elf is Entry Point?
An entry point is considered to be the first point to be made in a program. So if I start at any position in the program to start analyzing it can be considered an entry point is not ??
please help ...
- 69
4
votes
1
answer
532
views
How to deal with this "error" instructions generated by objdump?
So basically I am using objdump to disassemble a binary from GNU Coreutils, on 32-bit Linux x86.
In the disassembled code, I found one "broken" instruction like this:
804b4db: ff 24 85 e4 09 ...
- 2,465
4
votes
2
answers
5k
views
How to decompile external functions of *.so library in ELF with Ghidra?
There are some *.so libraries in my ELF file.
I can see the *.so names in "Imports" directory of "Symbol Tree" Window in Ghidra tool.
I think there are some external functions in ...
- 109
4
votes
2
answers
3k
views
Edit an .so file
I have here an .so file that contains a language pack and I want to edit them. My problem is that I don't always have enough space for a clean translation.
I know that I can change the texts if they ...
- 83
4
votes
3
answers
2k
views
How can I get the byte size of an operand in IDA Pro?
I am trying to get the byte size of all operands in a given instruction from IDA Pro. At first I tried using GetOperandValue(ea,n) to see how large the value was and calculate how many bytes were ...
- 380
4
votes
1
answer
2k
views
What are the first 16 bytes in .rodata section?
What are the first 16 bytes in the .rodata section?
For example, I have the following code:
#include <cstdio>
void myprintf(const char* ptr) {
printf("%p\n", ptr);
}
int main() {
...
- 143