Questions tagged [elf]

the Executable and Linkable Format is the main executable and object format for Linux, Solaris, *BSD, and many other OSes...

Filter by
Sorted by
Tagged with
5
votes
1answer
7k views

How to export a working elf binary from Ghidra?

When patching a program and then using the export binary function, it turns the elf headers are corrupt. Is there any way to work around this problem?
11
votes
3answers
5k views

What are the available libraries to statically modify ELF executables?

I would like to be able to rewrite or reorganize an ELF binary program directly from the executable format (not at compile-time). The only library I know to do this is elfesteem (used in Miasm). But,...
-1
votes
1answer
404 views

Extract PYZ Error

I successfully recovered some PYC files from an ELF built by PyInstaller (https://github.com/extremecoders-re/pyinstxtractor/wiki/Extracting-Linux-ELF-binaries). There is a PYZ archive in the dump. I ...
1
vote
1answer
68 views

debugging an older version of libc

I'm trying to understand heap exploitation better. Therefore, I compiled the following file: https://github.com/shellphish/how2heap/blob/master/glibc_2.25/fastbin_dup_into_stack.c I have the newest ...
1
vote
2answers
146 views

How to decompile external functions of *.so library in ELF with Ghidra?

There are some *.so libraries in my ELF file. I can see the *.so names in "Imports" directory of "Symbol Tree" Window in Ghidra tool. I think there are some external functions in ...
0
votes
1answer
53 views

Is an ELF SHT_RELA section with a 0 `sh_link` valid?

I have an 64-bit s390x ELF binary with a RELA section named ".rela.plt" whose sh_link field is 0. I was under the impression that the sh_link is a required value, providing the id of the ...
2
votes
1answer
218 views

How can I find an external function code correctly in Ghidra and Radare2?

This is a code to call an external function(get_random_name) in the main function push {fp, lr} add fp, sp, 4 sub sp, sp, 0x1d8 str r0, [fp, -0x1d8] str r1, [fp, -0x1dc] sub r3, fp, 0x44 ...
1
vote
2answers
118 views

How to reverse engineering ARM architecture ELF file on AMD linux?

I am reversing an ELF file, it's ARM architecture file. But my OS is AMD linux. How can I do reversing work for the ARM ELF file on AMD linux?
0
votes
2answers
77 views

Is it possible to reverse CGI binary file?

I wanna reverse CGI binary file. Is it possible? What are the recommended tools and guides? Thank you for reading my question. $ file test.cgi status.cgi: ELF 32-bit LSB executable, ARM, EABI5 ...
9
votes
2answers
10k views

What is a good and reliable C decompiler that support ELF and SH4 Architecture?

I have a ELF file, which is a partial firmware of a navigation module(my BMW idrive CCC), I need to decompile the elf file. I tried Reko Decompiler which said it does not support SH4 and Snowman ...
1
vote
1answer
150 views

How to disable relro while compilation?

#include <stdio.h> #include <stdlib.h> int main(int argc, int *argv[]) { size_t *p = (size_t *) strtol(argv[1], NULL, 16); p[0] = 0xDEADBEEF; printf("RELRO: %p\n", p); return ...
1
vote
1answer
170 views

startup program exits with code 126 when executing program at entrypoint

I want to reverse engineer a program. I managed to find the entry point but every time I want to launch the application I get the same error `During startup program exited with code 126. Here is what ...
2
votes
1answer
137 views

What is actually loaded here and different hexdump outputs on util-linux hexdump and on cutter and ghidra's hexdump

I was trying to understand what segment of file gets loaded by fourth LOAD header on phdr array. First 6 headers are shown below from readelf Program Headers: Type Offset ...
1
vote
0answers
68 views

Tool/parser for symbol tables produced with objdump -t to be used with IDA / Ghidra?

Working with a binary (arm64) file that seems to be some sort of a broken ELF file. The header data is missing and for some reason it contains a symbol table in a format that to me seem to be equal to ...
0
votes
1answer
411 views

Disassembling Hexagon - Corrupted ELF

I downloaded and unpacked the modem from Google source, after that I used laginimaineb's script to unify all modem binary data. However, when loading this binary to IDA, I get an error says: "Binary ...
18
votes
4answers
18k views

Set a breakpoint on GDB entry point for stripped PIE binaries without disabling ASLR

Given a position-independent, statically-linked, stripped binary, there does not appear to be a way in GDB to set a breakpoint at the entry point without disabling ASLR. break start and similar ...
5
votes
2answers
12k views

Decoding the UPX ELF header file

Still on my way to understand how to prevent the usage of the -d (decompress) option of UPX (see this question), I try to identify the header file of UPX in ELF executable files. Looking at the code, ...
2
votes
1answer
90 views

Can't modify string in radare2 (.rodata section)

I was following the response to this question to change the string of an elf executable. No matter how many times I try, I just can't modify the string. I notice that probably the issue lies in the ...
-1
votes
1answer
337 views

Practicing what SHOULD be a simple crackme. Program calls strlen() but never returns

I'm trying out a crackme from the "LSE CTF" called "Blue Box" worth only 10 points. I've attempted this inside GDB and radare2... It is very simple, takes one argument and first checks to make sure ...
0
votes
0answers
143 views

Reversing an ELF file

I am a beginner in reverse-engineering and am trying to understand what a custom ELF file is doing with a particular file (File1) it is reading from the system. File1 is in a custom format. Using ...
1
vote
1answer
524 views

How to open new window of decompiler or resize the decompiler of Ghidra?

This is very small and inconvenient to read. How do i open new Window (any shortcut key) or resize it, for some reason i cant resize. Any help? EDIT: Oh thanks Shane Riley, i clicked the blue button ...
11
votes
4answers
7k views

How can I generate a call graph from an unstripped x86 Linux ELF?

There's a piece of software, for which I only have the binary, not the source code. It's: unobfuscated (so, not polymorphic or anything. It is optimized a bit, though) unstripped x86 32 bit ...
1
vote
1answer
52 views

How to split bytes into instructions in binary ELF file for x86

I'm working on a static code injector for ELF files. I need to "steal" some bytes in order to write jump to my code on their place and then execute stolen instructions somewhere in the ...
1
vote
1answer
74 views

Injecting code into an ELF binary , got Segmentation fault(SIGSEGV)

I am currently working on an ELF-injector and my approach is standard: find code cave (long enough sequence of 0's), rewrite it with the instructions I want to execute and then jump back to the start ...
0
votes
1answer
53 views

What does this custom piece of frame manipulation code from a router binary do?

I've decompiled a custom router ELF binary using Hex-Rays and have recently come across the following function in the binary: pkt_hdr_t *__cdecl pkt_hdr_from_frame(frame_t *frame, uint16_t *remaining) ...
0
votes
1answer
50 views

Call libc functions from the payload statically injected into ELF binary

I am working on ELF-injector, which given some payload (currently it's an assembly file with .text section only) will inject it into ELF binary. I had related post here. Now I would like to make it ...
0
votes
0answers
38 views

Bypassing debugger detection in radar2

I'm currently doing a reversee engineering challenge. I disassembled the ELF binary in radare2, however the binary checks whether its attached to a debugger. How can i bypass this detection ? Thanks ...
3
votes
1answer
272 views

ELF binary injection

I am currently working on an ELF-injector and my approach is standard: find code cave (long enough sequence of 0's), rewrite it with the instructions I want to execute and then jump back to the start ...
1
vote
1answer
63 views

Name other than “.text” for the main code section

Is it safe to assume that, in the general case, the name of the section containing the user code (not the compiler generated code) is .text? I spot-checked several ARM, x86 and MIPS binaries (PE and ...
2
votes
3answers
6k views

Where can I get Linux malware samples?

There have been numerous sites stated in this wonderful post that one could retrieve malware samples. However, I am having a difficult time (sorry D:) locating Linux-specific malware from those sites ...
1
vote
1answer
443 views

Find functions names in .init_array section in unstripped library

Is it possible to find out all instances of static initialization in a elf dynamic library. I can dump the array of function pointers in .init_array section via objdump command like this. objdump -s -...
1
vote
0answers
83 views

Dynamic Analysis with gdb on ELF binaries with no compilation/linking information

I am trying to do some dynamic analysis on a couple of ELF binaries with gdb. However, since those two are directly downloaded (ELF binary file only) with no additional information related to ...
0
votes
1answer
97 views

How do i identify parameters function of md5sum of specific binary?

So, i downloaded the binary. Here are some details before moving forward: revbinary: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2,...
1
vote
2answers
69 views

What is the state of the stack in the entry function?

I have an ELF binary and in the entry function the first two instructions are: XOR EBP, EBP POP ESI I'm curious what the state of the stack is at the start of the entry function in ELF and PE ...
3
votes
3answers
568 views

Patching PLT entries

I was reading this CTF write up and wanted to know more than the author cared to explain. I actually just patched the PLT entries of getenv(), ptrace() and sleep(), as sleeps get pretty annoying ...
0
votes
0answers
342 views

Modify Strings in a ELF (Executable and Linking Format) that are stored in the .rodata

I have 2 ELF files here, each containing strings in the ".rodata" for an translation that I want to modify. The first ELF "(binary1)" I have already successfully modified from ...
0
votes
1answer
91 views

Generating an elf header

To get a basic understanding of the ELF format, I'm writing a basic program to generate a valid elf file from the most basic assembly output. I'm going step-by-step so I'll probably ask a few ...
3
votes
2answers
1k views

Meaning of Flags in ELF Section header?

Given this classic helloworld.c example, #include <stdio.h> int main() { printf("Hello world!\n"); } In below sections output, the value for Flags presents a couple of different values, e....
0
votes
0answers
76 views

How is ELF symbol resolution and relocation different from PE symbol resolution?

I've learned extensively about PE and PE64 format a while back. I am now digging deeper into ELF format. However, I've not found as many thorough resources for ELF as I did for PE, such as ARTeam's PE ...
1
vote
0answers
45 views

Statically injecting translated NASM assembly into existing ELF binary

I'm trying to statically patching ELF binaries in order to incorporate code that can help provide run-time protection. In an effort to save time writing and debugging assembly, I took the following no-...
3
votes
1answer
2k views

Is there a way to debug an elf file that runs with no problems with damaged header?

My question is general, but to have an example to work with, let us take one from Whirlwind Tutorial. ; tiny.asm BITS 32 org 0x00010000 db 0x7F, "ELF" ; ...
1
vote
1answer
51 views

How are members of a Structure Type positioned on the stack?

Some of the structure types have members that are not stacked next to each other. Check out the structure type at 0x33E6 in bzip2_base (x86-64) here. There's an int at location offset 0, a char at 4 ...
0
votes
1answer
47 views

How is padding size calculated for members of structure types?

Looking at DWARFs of bzip2_base I see different offsets between members of a structure type although they are of the same type. Check _IO_FILE structure at the offset 0x9c here. All the way until the ...
1
vote
1answer
45 views

GDB exited when running library

I'm new with gdb and I have spent hours looking for direction but I can't find any. I need to analyze an executable to find how this program process the arguments and where the output came from. I ...
8
votes
0answers
473 views

Extracting strings from Go binaries

Is there an easy way to extract all of the strings from Go binaries that will work cross architecture? The problem with Go is that strings are stored without a null terminator so you can't use the "...
108
votes
2answers
92k views

What is PLT/GOT?

From time to time, when disassembling x86 binaries, I stumble on reference to PLT and GOT, especially when calling procedures from a dynamic library. For example, when running a program in gdb: (gdb)...
0
votes
0answers
63 views

Combine two ELF binaries

Without having access to the original source code, is there a way to combine two ELF binaries with the main() in the first binary pointing to the main() in the second binary ? In other words, I mean ...
3
votes
3answers
1k views

Elf x86_64 adding function

I'm trying to see if I can append function code in the .text section of an ELF while still maintaining the execution flow of the original ELF. Ideally, I want to call the new function but that's it's ...
4
votes
2answers
2k views

Edit an .so file

I have here an .so file that contains a language pack and I want to edit them. My problem is that I don't always have enough space for a clean translation. I know that I can change the texts if they ...
1
vote
0answers
42 views

dwarf: variable offset from base

I have a simple code: int main() { int a = 4; printf("%d\n", a); a = 8; if (a == 8) printf("%d\n", a); return 0; } DIEs for the function and variable: <1><32a>: Abbrev ...

1
2 3 4 5