Questions tagged [elf]

the Executable and Linkable Format is the main executable and object format for Linux, Solaris, *BSD, and many other OSes...

Filter by
Sorted by
Tagged with
0
votes
0answers
15 views

Dynamic Analysis with gdb on ELF binaries with no compilation/linking information

I am trying to do some dynamic analysis on a couple of ELF binaries with gdb. However, since those two are directly downloaded (ELF binary file only) with no additional information related to ...
0
votes
1answer
25 views

Extract PYZ Error

I successfully recovered some PYC files from an ELF built by PyInstaller (https://github.com/extremecoders-re/pyinstxtractor/wiki/Extracting-Linux-ELF-binaries). There is a PYZ archive in the dump. I ...
0
votes
1answer
65 views

How do i identify parameters function of md5sum of specific binary?

So, i downloaded the binary. Here are some details before moving forward: revbinary: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2,...
1
vote
2answers
50 views

What is the state of the stack in the entry function?

I have an ELF binary and in the entry function the first two instructions are: XOR EBP, EBP POP ESI I'm curious what the state of the stack is at the start of the entry function in ELF and PE ...
1
vote
1answer
27 views

debugging an older version of libc

I'm trying to understand heap exploitation better. Therefore, I compiled the following file: https://github.com/shellphish/how2heap/blob/master/glibc_2.25/fastbin_dup_into_stack.c I have the newest ...
0
votes
0answers
71 views

Modify Strings in a ELF (Executable and Linking Format) that are stored in the .rodata

I have 2 ELF files here, each containing strings in the ".rodata" for an translation that I want to modify. The first ELF "(binary1)" I have already successfully modified from ...
0
votes
0answers
23 views

How to open new window of decompiler or resize the decompiler of Ghidra?

This is very small and inconvenient to read. How do i open new Window (any shortcut key) or resize it, for some reason i cant resize. Any help? EDIT: Oh thanks Shane Riley, i clicked the blue button ...
0
votes
1answer
57 views

Generating an elf header

To get a basic understanding of the ELF format, I'm writing a basic program to generate a valid elf file from the most basic assembly output. I'm going step-by-step so I'll probably ask a few ...
1
vote
0answers
32 views

Statically injecting translated NASM assembly into existing ELF binary

I'm trying to statically patching ELF binaries in order to incorporate code that can help provide run-time protection. In an effort to save time writing and debugging assembly, I took the following no-...
0
votes
0answers
44 views

How is ELF symbol resolution and relocation different from PE symbol resolution?

I've learned extensively about PE and PE64 format a while back. I am now digging deeper into ELF format. However, I've not found as many thorough resources for ELF as I did for PE, such as ARTeam's PE ...
1
vote
1answer
47 views

How are members of a Structure Type positioned on the stack?

Some of the structure types have members that are not stacked next to each other. Check out the structure type at 0x33E6 in bzip2_base (x86-64) here. There's an int at location offset 0, a char at 4 ...
0
votes
1answer
30 views

How is padding size calculated for members of structure types?

Looking at DWARFs of bzip2_base I see different offsets between members of a structure type although they are of the same type. Check _IO_FILE structure at the offset 0x9c here. All the way until the ...
1
vote
1answer
35 views

GDB exited when running library

I'm new with gdb and I have spent hours looking for direction but I can't find any. I need to analyze an executable to find how this program process the arguments and where the output came from. I ...
8
votes
0answers
138 views

Extracting strings from Go binaries

Is there an easy way to extract all of the strings from Go binaries that will work cross architecture? The problem with Go is that strings are stored without a null terminator so you can't use the "...
0
votes
0answers
52 views

Combine two ELF binaries

Without having access to the original source code, is there a way to combine two ELF binaries with the main() in the first binary pointing to the main() in the second binary ? In other words, I mean ...
0
votes
0answers
74 views

How to force IDA to properly parse the ELF header?

Is possible to force IDA to parse the elf file into its appropriate fields without resorting to IDC/IDApython, I mean is there a built-in functionality that I'm missing? For instance it possible to ...
1
vote
0answers
30 views

dwarf: variable offset from base

I have a simple code: int main() { int a = 4; printf("%d\n", a); a = 8; if (a == 8) printf("%d\n", a); return 0; } DIEs for the function and variable: <1><32a>: Abbrev ...
0
votes
0answers
37 views

Shellcode execution segfault

I have been trying to exploit simple buffer overflow caused by scanf. I'm working on x86 Linux. The point is to spawn a shell. I sucesfully overwritten return address and jumped into my shellcode. But ...
0
votes
1answer
85 views

“check:” keyword in Ghidra

I have disassembled the crackme0x06 challenge (http://security.cs.rpi.edu/courses/binexp-spring2015 inside challenges.zip). It's an ELF 32bit unstripped binary. The decompiled C code using Ghidra ...
0
votes
0answers
51 views

What does the file pointer of fgets actually point to in linux?

So i was reversing a 64 bit ELF binary, and it did a call to fgets, and based on documentation the third argument of fgets is a file pointer. now the weird part was that the third argument in this ...
0
votes
0answers
73 views

CHBByteStream operator<<, get only one argument - value

Anyone heard about CHBByteStream? It's from Harman headunit (car radio). I don't know how it's passing arguments. SWID is 4 bytes, VIN is 17 bytes, it should be connected in some way, to pass thru ...
2
votes
1answer
485 views

Ghidra python - get program base address

What is the way to get the program base address in Ghidra?
0
votes
1answer
212 views

Dumping the GOT with gdb at run time

I want to see how the plt stubs are being resolved at run time when lazy linking is used and how the GOT is changed along the way. How can I dump the GOT with gdb?
0
votes
1answer
104 views

Conditional to check bytes against user input [ELF 32-bit]

I'm trying to understand the following snippet code from a CTF binary. It is part of an ELF 32-bit and I decompiled it with Ghidra. undefined4 check_serial(char *code) { size_t sVar1; undefined4 ...
0
votes
1answer
441 views

Can “missing section headers” ELF files still be executed/dangerous?

On VirusTotal, there are lots of ELF samples are missing section headers when using file command to see the info. Also, when using the Python elftools library to parse them, exceptions will be thrown....
1
vote
1answer
134 views

GCC is not recognizing symbol table in my hand-made ELF file

For learning purposes I've created (using a hex editor and some macros) the following ELF file: hello.o: ELF 64-bit LSB relocatable, x86-64, version 1 (SYSV), not stripped xxd hello.o: 00000000: ...
2
votes
1answer
125 views

ELF imported symbols colision

From what I understand, the ELF format doesn't specify which symbols come from which file - Every ELF that uses import has a list of symbols to import and list of file names, and the loader is trying ...
1
vote
1answer
154 views

ELF file crashing after executing shellcode

So after changing the entry point via the e_entry field I managed to execute my shellcode before returning control to the original entry point. Here's how I did it: // write string and jump to OEP, ...
6
votes
2answers
200 views

Reassembling ELF binary files

I have been doing a number of CTF activities when I came across something I’m unfamiliar with. As I am somewhat new to exploitation and reverse engineering, this was unfamiliar to me. I have 7 pieces ...
2
votes
1answer
96 views

Importance of learning file structures for reverse engineering?

I'm new to reverse engineering and I have started to study the anatomy of specific file formats, specifically PE right now. I really enjoy learning the different parts of the files and the different ...
0
votes
1answer
140 views

Convert PIE ELF binary into No-PIE

Is it possible changing few bytes for converting an elf binary from PIE to No-PIE (ELF)? I know that in the header if e_type is: - 3 then the program is PIE - 2 then the program is No-PIE So I ...
3
votes
1answer
57 views

ELF file format find shared object for symbol

(in Windows) PE file format contains Import table with Module\Dll Name which tells PE loader where to search for symbol e.g. KERNEL32.dll -> CreateFileW In the ELF file format there is Symbol ...
4
votes
2answers
288 views

Struct reconstruction in decompilers

I'm testing several decompilers about struct reconstruction, given the following C example: struct S { int x; int y; long z; long t; }; int foo(struct S s) { return s.x + s.y + s....
1
vote
1answer
142 views

How to use x64-86 elf file from an apk file in a linux machine?

I'm building a jar file that use jni to load an x86-64 elf extracted from Android apk file. But when I run my app, it throw this exception: Caused by: java.lang.UnsatisfiedLinkError: /lib/x86_64-...
1
vote
1answer
93 views

Why is IDA showing three arguments for the main function instead of two in some linux binaries?

So I am reversing an ELF‌ binary, now from my knowledge in C the main function has two argument, argc and argv but some linux binaries that i am reversing have 3 when i decompile them! one int and ...
3
votes
1answer
138 views

IAT vs GOT address resolving: which of them resolve during runtime and which during load time by default?

So based on my knowledge on windows apps, as far as i know the IAT gets filled with correct addresses when the library gets loaded (correct me if I'm wrong) now in linux, they use GOT, and again ...
0
votes
1answer
67 views

problem rewriting ELF binary to add an additional loadable segment

I have a problem rewriting ELF binary to add an additional loadable segment for add.c code. I have problem working with https://pdfhost.io/v/U@uP1+nCY_Compact_Control_Flow_Integerity_in_Linuxpdf.pdf ...
0
votes
1answer
106 views

How to determine when/where pointers in .ctors get mapped?

So I am learning about ELF, and am looking through a binary in Ghidra as I do. I've made sense of the ELF header, and now I am looking through the program header table. My binary has a bunch of ...
2
votes
3answers
595 views

Elf x86_64 adding function

I'm trying to see if I can append function code in the .text section of an ELF while still maintaining the execution flow of the original ELF. Ideally, I want to call the new function but that's it's ...
2
votes
1answer
109 views

What is actually loaded here and different hexdump outputs on util-linux hexdump and on cutter and ghidra's hexdump

I was trying to understand what segment of file gets loaded by fourth LOAD header on phdr array. First 6 headers are shown below from readelf Program Headers: Type Offset ...
3
votes
1answer
558 views

Why have two symbols tables?

Why have two symbol tables if .symtab already contains everything that's in .dynsym ?
2
votes
2answers
580 views

Meaning of Flags in ELF Section header?

Given this classic helloworld.c example, #include <stdio.h> int main() { printf("Hello world!\n"); } In below sections output, the value for Flags presents a couple of different values, e....
2
votes
1answer
156 views

LD_BIND_NOW doesn’t seem to take effect on ELF PIE executable?

Observations When the Linux executable is compiled as PIE (Position Independent Executable, default on Ubuntu 18.04), the symbols from shared libraries (e.g. libc) will be resolved when the program ...
3
votes
1answer
259 views

ELF x86 - Why is return address pushed twice?

I reverse an ELF x86, and I would like to understand why the return address is pushed again on the stack? It should be already present there. main: lea ecx, [esp+0x4 {argc}] and esp, 0xfffffff0 ...
1
vote
1answer
624 views

Changing entry-point of and ELF file

I'm trying to conduct a little experiment which basically consists of changing the EP of an ELF file and executing an exit(9) syscall, without returning to the OEP. As shown in the image everything ...
-1
votes
1answer
582 views

How reverse a stripped binary (Find the main function)

I'm learning the reverse, and I'm trying to reverse a stripped binary (flag: ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, stripped). I manage to go to the entry address ...
1
vote
0answers
2k views

Reversing ELF 64-bit LSB pie executable [duplicate]

I have a file crackme, which is an executable. hamuto@hamuto-pc:~/Security/NOOB/FruitSalad$ file crackme crackme: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, ...
1
vote
1answer
556 views

How to find the starting address of main function when the binary is stripped and _start doesn't push the absolute address value of main?

So let's say the ELF binary is stripped - meaning no symbol table - and the _start function doesn't push the address of main before calling __libc_start_main. This happened in a binary when compiled ...
4
votes
1answer
119 views

How to find the index of static ilbrary functions in the PLT of the binary?

So right now I'm trying to resolve function calls and their names in my reversing tool the problem I'm having is that library functions such as printf and fwrite and such do not have a corresponding ...
2
votes
3answers
314 views

Is the main function's name in the symbol table of C & C++ programs always 'main'? if not, how to find the name?

So I'm trying to write a reversing tool that parses symbol table to find the main function's address right now all the binaries I'm checking the name of main function is still main in symbol table ...

1
2 3 4 5