Questions tagged [elf]

the Executable and Linkable Format is the main executable and object format for Linux, Solaris, *BSD, and many other OSes...

Filter by
Sorted by
Tagged with
26
votes
1answer
82k views

Reversing ELF 64-bit LSB executable, x86-64 ,gdb

I'm a newbie and just got into RE. I got a ELF 64-bit LSB executable, x86-64. I'm trying to reverse it. First I tried to set a break point on line 1 using gdb ./filename break 1 The gdb says No ...
11
votes
3answers
5k views

What are the available libraries to statically modify ELF executables?

I would like to be able to rewrite or reorganize an ELF binary program directly from the executable format (not at compile-time). The only library I know to do this is elfesteem (used in Miasm). But,...
108
votes
2answers
92k views

What is PLT/GOT?

From time to time, when disassembling x86 binaries, I stumble on reference to PLT and GOT, especially when calling procedures from a dynamic library. For example, when running a program in gdb: (gdb)...
26
votes
1answer
24k views

What symbol tables stay after a strip In ELF format?

I am currently looking at the ELF format, and especially at stripped ELF executable program files. I know that, when stripped, the symbol table is removed, but some information are always needed to ...
18
votes
4answers
18k views

Set a breakpoint on GDB entry point for stripped PIE binaries without disabling ASLR

Given a position-independent, statically-linked, stripped binary, there does not appear to be a way in GDB to set a breakpoint at the entry point without disabling ASLR. break start and similar ...
2
votes
3answers
6k views

Where can I get Linux malware samples?

There have been numerous sites stated in this wonderful post that one could retrieve malware samples. However, I am having a difficult time (sorry D:) locating Linux-specific malware from those sites ...
27
votes
4answers
37k views

Cross debugging for ARM / MIPS ELF with QEMU/toolchain

as i'm new about cross-debugging and cross-compilation i need some help because i feel so confused. I have a MIPS elf file, [myelf][1] .You can see bellow the output of file myelf: myelf: ELF 32-bit ...
16
votes
4answers
11k views

How to generate the call graph of a binary file?

I have a non-stripped ELF binary for which I want to create a call graph as a dot file. Is there such a tool which generates the call graph? EDIT: Is there away in addition to the conventional call ...
2
votes
1answer
3k views

IDA Pro debugging: follow child process

I'm reverse engineering a malware that creates a number of child processes and I'm trying to do dynamic analysis of the ELF binary with IDA Pro and IDA's Local Linux Debugger, but I can't get IDA to ...
58
votes
7answers
15k views

Visualizing ELF binaries

I recently saw an older talk by Sergey Bratus and Greg Conti by the name of Voyage of the Reverser: A Visual Study of Binary Species. Are there any opensource/free tools that one could use to see ...
5
votes
3answers
9k views

Packers/Protectors for Linux

I was wondering if anyone had come across a packer/protector which could be used for ELF binaries. There seem to be quite a few articles on writing packers and protectors for the PE format -- however, ...
6
votes
2answers
2k views

Writing ELF headers in Radare?

Reading Keith Makan's, "Introduction to the ELF Format : The ELF Header", he modifies e_entry, The e_entry field lists the offset in the file where the program should start executing.Normally it ...
7
votes
2answers
3k views

How to recover information stored in .ctors section?

Test is on x86, 32-bit Linux. I am using g++ 4.6.3 and objdump 2.22 Here is a simple C++ code I am working on: #include <iostream> using namespace std; main() { cout << "Hello ...
5
votes
1answer
7k views

How to export a working elf binary from Ghidra?

When patching a program and then using the export binary function, it turns the elf headers are corrupt. Is there any way to work around this problem?
4
votes
1answer
4k views

Why are symbols with local binding present in the symbol table of my ELF files?

I found out that there are symbols with binding=LOCAL and visibility=HIDDEN in the symbol table (.symtab) of ELF executables/libraries. What are they needed for? They are not involved in the ...
6
votes
2answers
10k views

Fixing corrupt ELF header field “e_shnum” for use in GDB

If the ELF header which usually can be read using readelf has been manually manipulated, let's say by increasing the value for the "Size of section headers" the binary still can be executed and works ...
3
votes
1answer
272 views

ELF binary injection

I am currently working on an ELF-injector and my approach is standard: find code cave (long enough sequence of 0's), rewrite it with the instructions I want to execute and then jump back to the start ...
3
votes
1answer
303 views

ELF x86 - Why is return address pushed twice?

I reverse an ELF x86, and I would like to understand why the return address is pushed again on the stack? It should be already present there. main: lea ecx, [esp+0x4 {argc}] and esp, 0xfffffff0 ...
1
vote
1answer
1k views

IDA - Remote debug on linux

I am trying to debug remotly an ELF from my windows 10 (the ELF runs on my ubuntu 32 bit vm) (the ELF is from pwnable.kr - unlink). Because the exploit is via gets() I try to pass input through the "...
0
votes
0answers
342 views

Modify Strings in a ELF (Executable and Linking Format) that are stored in the .rodata

I have 2 ELF files here, each containing strings in the ".rodata" for an translation that I want to modify. The first ELF "(binary1)" I have already successfully modified from ...
4
votes
2answers
477 views

Struct reconstruction in decompilers

I'm testing several decompilers about struct reconstruction, given the following C example: struct S { int x; int y; long z; long t; }; int foo(struct S s) { return s.x + s.y + s....
4
votes
1answer
387 views

How to deal with this “error” instructions generated by objdump?

So basically I am using objdump to disassemble a binary from GNU Coreutils, on 32-bit Linux x86. In the disassembled code, I found one "broken" instruction like this: 804b4db: ff 24 85 e4 09 ...
2
votes
1answer
2k views

Disassemblers resolving (ELF) section names

I'm working with linux executables and was just wondering how it is that section names are resolved to addresses upon disassembly of an ELF. For example take some random disassembly output from ...
1
vote
1answer
4k views

Unable to view stack and memory addresses in IDA Pro [duplicate]

I am debugging a 32-bit ELF executable using remote GDB debugging option of IDA Pro. However, I am unable to view the contents of stack in the stack view. Also, the stack pointer value is: 0xFFFFD328 ...
1
vote
1answer
51 views

How are members of a Structure Type positioned on the stack?

Some of the structure types have members that are not stacked next to each other. Check out the structure type at 0x33E6 in bzip2_base (x86-64) here. There's an int at location offset 0, a char at 4 ...
1
vote
2answers
146 views

How to decompile external functions of *.so library in ELF with Ghidra?

There are some *.so libraries in my ELF file. I can see the *.so names in "Imports" directory of "Symbol Tree" Window in Ghidra tool. I think there are some external functions in ...
0
votes
2answers
77 views

Is it possible to reverse CGI binary file?

I wanna reverse CGI binary file. Is it possible? What are the recommended tools and guides? Thank you for reading my question. $ file test.cgi status.cgi: ELF 32-bit LSB executable, ARM, EABI5 ...