Questions tagged [elf]

the Executable and Linkable Format is the main executable and object format for Linux, Solaris, *BSD, and many other OSes...

Filter by
Sorted by
Tagged with
15
votes
2answers
3k views

Why are GOT and PLT still present in Linux static stripped binaries?

I am looking at statically linked linux x86 stripped binary. I noticed that there are .got and .plt sections. I wonder what does a statically linked binary need got and plt sections for ? Anyone ?
7
votes
1answer
6k views

What is a good and reliable C decompiler that support ELF and SH4 Architecture?

I have a ELF file, which is a partial firmware of a navigation module(my BMW idrive CCC), I need to decompile the elf file. I tried Reko Decompiler which said it does not support SH4 and Snowman ...
57
votes
7answers
13k views

Visualizing ELF binaries

I recently saw an older talk by Sergey Bratus and Greg Conti by the name of Voyage of the Reverser: A Visual Study of Binary Species. Are there any opensource/free tools that one could use to see ...
1
vote
0answers
254 views

Accessing .rodata/.rel.data.ro

Analyzing an android ELF binary. How/where does something access a specific area of .rodata or .rel.data.ro? Have tried using objdump, rabin2, readelf, etc and I can't seem to figure out how it is ...
1
vote
1answer
2k views

Disassembling MIPS 32 version 1 binary with the Radare2 Framework

I am trying to disassemble a MIPS 32 version 1 binary with the Radare2 framework. Here is the full output of the file command: ELF 32-bit LSB executable, MIPS, MIPS32 version 1 (SYSV), dynamically ...
1
vote
1answer
176 views

Reuse symbols in disassembling/reassembling a C++ program

it's me again. I am working on a tool can that disassemble/reassemble stripped binaries and now I am sucked in a (external) symbol reuse issue. The test is on 32-bit Linux x86 platform. Suppose I ...
1
vote
1answer
3k views

Unable to view stack and memory addresses in IDA Pro [duplicate]

I am debugging a 32-bit ELF executable using remote GDB debugging option of IDA Pro. However, I am unable to view the contents of stack in the stack view. Also, the stack pointer value is: 0xFFFFD328 ...
-1
votes
1answer
296 views

Practicing what SHOULD be a simple crackme. Program calls strlen() but never returns

I'm trying out a crackme from the "LSE CTF" called "Blue Box" worth only 10 points. I've attempted this inside GDB and radare2... It is very simple, takes one argument and first checks to make sure ...
3
votes
1answer
998 views

Maximum size of .text section?

When the ELF file loading process, .text section is mapped to a memory segment. I would like to know: What is the maximum value of a segment size ? What is the maximum value of .text section size ?
2
votes
1answer
1k views

How to get the information of “how many and which symbols are resolved by linker”?

The test is on 32-bit Linux, x86. With gcc 4.6.3 and GNU ld 2.22. So I am trying to get the information of "how many symbols are resolved by linker" during link time? And how can I list the ...
24
votes
1answer
21k views

What symbol tables stay after a strip In ELF format?

I am currently looking at the ELF format, and especially at stripped ELF executable program files. I know that, when stripped, the symbol table is removed, but some information are always needed to ...
2
votes
1answer
2k views

IDA Pro debugging: follow child process

I'm reverse engineering a malware that creates a number of child processes and I'm trying to do dynamic analysis of the ELF binary with IDA Pro and IDA's Local Linux Debugger, but I can't get IDA to ...
3
votes
2answers
2k views

Changing Entrypoint in ELF executable

I wrote some code that does the following: Searches for and finds an offset in a binary file to add code (looks for a sequence of 00s I can overwrite). Then, I change the entrypoint of the ELF to ...
4
votes
1answer
287 views

How to deal with this “error” instructions generated by objdump?

So basically I am using objdump to disassemble a binary from GNU Coreutils, on 32-bit Linux x86. In the disassembled code, I found one "broken" instruction like this: 804b4db: ff 24 85 e4 09 ...
0
votes
1answer
102 views

how Can I use a linux so file from a program other than the program it was developed for?

I wish to use the codecs that come with realplayer but without needing realplayer. The codecs I want to use are all in .so format, but I don't know how to separate the codecs from the rest of ...
1
vote
1answer
839 views

GNU objcopy: elf to hex missing sections

I am using objcopy to convert elf to hex. When I disassemble the elf in IDA Pro, all the sections are present, but they are missing from my hex and it seems the elf headers: C:\TricoreGCC>tricore-...
9
votes
3answers
6k views

How can I generate a call graph from an unstripped x86 Linux ELF?

There's a piece of software, for which I only have the binary, not the source code. It's: unobfuscated (so, not polymorphic or anything. It is optimized a bit, though) unstripped x86 32 bit ...
0
votes
2answers
7k views

Is it possible to debug an ELF file with a Windows-based disassembler?

Problem : How can I debug an ELF file in MS Windows? is it possible? Scenario : I have an ELF file compiled to work on hardware with VXWorks 5.5 OS and SH4 CPU. IDA68 is able to disassemble the file ...
4
votes
1answer
3k views

Why are symbols with local binding present in the symbol table of my ELF files?

I found out that there are symbols with binding=LOCAL and visibility=HIDDEN in the symbol table (.symtab) of ELF executables/libraries. What are they needed for? They are not involved in the ...
1
vote
0answers
408 views

Elf binary manipulation tool on ARM

Do you know any free tool for binary manipulation elf file on ARM, something like ERESI elfsh for Intel? Purpose - adding instructions into existing binary elf file.
1
vote
1answer
3k views

How do I find where a String is referenced in IDA Pro?

Please bear in mind I am very new to all this - however I have searched and could not easily find an answer to my issue. I have an elf (actually an Android aboot image based upon LK) that I loaded ...
2
votes
1answer
1k views

Finding hidden string location using radare2 on ELF binaries

I'm working through some reverse engineering sample programs (IOLI crackmes) crackme0x00 - crackme0x09 which are gcc compiled ELF format binaries. I was provided these by a colleague and can be ...
3
votes
1answer
1k views

Replace section inside ELF file

Is it possible to replace a non-code section inside an ELF file? If so, then how? Is there something I would have to consider before simply replacing the bytes by some other bytes (of course nothing ...
1
vote
1answer
553 views

Relocate ELF symbols

How can I apply relocations of symbols in an elffile? I'm currently trying to archive this with pyelftools. Strangely, I could hardly find any information on how to do this, although some projects ...
2
votes
0answers
346 views

Using __kernel_vsyscall on x64 linux machine [closed]

I am trying to use __kernel_vsyscall instead of syscall/int 80 on linux x64. I have read that it can be done on Intel chips (I have one), but i can't find how can one do it. I have x32 version: int ...
0
votes
3answers
345 views

What exactly is this piece of assembly code doing?

This assembly is for Intel x86-64 bit, seems to be too baffling to me. How come the jz instruction jump to a non-instruction (0x400AC9)? How come the call invokes a non-existing address? For curious ...
0
votes
1answer
9k views

Debug ELF executable

I cannot load the following executable type in OllyDbg: - ELF 32-bit LSB executable, Intel 80386 Why can OllyDbg not handle this kind of executables? What are good (OllyDbg-like) debuggers to debug ...
0
votes
1answer
188 views

What segment do ELF SHN_COMMON objects get allocated in?

I am trying to understand the contents of an ELF relocatable object (*.o file), which appears to be a Fortran file compiled to SPARC object code. I am looking at the sections below, which all look ...
1
vote
1answer
241 views

Is it possible to rebuild an nexe file if I can read at arbitrary untrusted memory addresses?

Ok, I’m in a remote situation where I don’t have access to the remote filesystem but where I can run arbitrary python code (except I can’t fork processes and I don’t have access to ulimit and uname). ...
3
votes
1answer
761 views

How to determine which thread implementation binary compiled with

Is it possible to determine if a binary (static or shared and not stripped) is compiled with Linuxthreads or NPTL implementation ?
2
votes
1answer
895 views

Insert a function call in an ELF executable

I want to patch an ELF executable to insert a function call (the function s2e_rawmon_loadmodule and its dependencies are to be linked statically, preferably) at the beginning. This answer seems to ...
1
vote
1answer
292 views

Append Code To Text Segment With Global Variables?

I have a powerpc computer that takes ELF files for its code. I have made a tool that allows me to extract and inject segments successfully, but I am missing a small piece of information regarding the ...
1
vote
2answers
156 views

Figure out whether a function has return value of not?

I am doing binary analysis on x86-64bit ELF binaries. All the binaries are compiled from C language. Basically, for a given function, I would like to figure out whether this function has a return ...
7
votes
2answers
3k views

How to recover information stored in .ctors section?

Test is on x86, 32-bit Linux. I am using g++ 4.6.3 and objdump 2.22 Here is a simple C++ code I am working on: #include <iostream> using namespace std; main() { cout << "Hello ...
2
votes
2answers
310 views

Dynamic analysis of malware samples

I have thousands of Linux malware samples in ELF format. And I am thinking to use dynamic analysis (say, PIN) to obtain an execution trace of each malware sample. However, I am afraid such activity ...
1
vote
1answer
297 views

Variable liveness analysis on binaries

I want to detect all the variables live at any instruction/address in a binary. By variable, I refer to both global as well as function local variables. In other words, given a Linux ELF and a virtual ...
2
votes
0answers
261 views

Modern equivalent to rsymtab for reconstructing symbol table for statically linked / stripped binaries?

I'm working with a 32-bit ELF binary that (I believe) has been statically linked against a few different third-party libraries. It has also been stripped, so I don't have much to go on with respect to ...
2
votes
0answers
1k views

Debugging a position independent executable ELF

I am trying to follow the write-up about hackercalc (a challenge for DEFCON 2015 quals). First, by loading the challenge into gdb, I observe that: (gdb) info files ... Entry point: 0xcf8 ... So I ...
2
votes
1answer
2k views

Finding the library an imported function is from in IDA

I'm fairly new to reversing, and I have even less experience with IDA Pro. I am wondering if there is a way to figure out from where an imported function is imported, i.e. a memory location I can find ...
4
votes
1answer
995 views

Illegal entry point of an ELF file

I have encountered a quite obscure 32-bit ELF file (that is a crackme) and I still cannot figure out how can it execute. First, beside some "understandable" property that it has not any section: # ...
4
votes
6answers
7k views

How to match disassembled instructions back to C/C++ source?

Basically here's what I want to know, if you have a disassembled instruction say: jz 0x8048e1a And, you also have the source code. How do you go about figuring out what this instruction relates to ...
2
votes
2answers
4k views

Where can I get Linux malware samples?

There have been numerous sites stated in this wonderful post that one could retrieve malware samples. However, I am having a difficult time (sorry D:) locating Linux-specific malware from those sites ...
4
votes
1answer
2k views

ELF: How to make IDA show me the correct PLT (Procedure Linkage Table) content?

I would like to make IDA disassemble the .plt section of ELF files correctly, e.g. as objdump does: objdump -D -M intel asdf | grep "Disassembly of section .plt" -A80 I don't know why but IDA gives ...
5
votes
1answer
3k views

How to create a IDA FLIRT signature for a PPC library?

I'd like to create a IDA FLIRT signature for the following PPC uClibc library: libuClibc-0.9.15.so: ELF 32-bit MSB shared object, PowerPC or cisco 4500, version 1 (SYSV), dynamically linked, for GNU/...
6
votes
1answer
9k views

Which python library for parsing Linux ELF files?

I want to be able to parse 32 and 64 bit ELF files - but not create or modify them (e.g. as discussed in this thread). The ELF binaries may possibly come from embedded Linux systems, that is, the ...
2
votes
2answers
363 views

Patching PLT entries

I was reading this CTF write up and wanted to know more than the author cared to explain. I actually just patched the PLT entries of getenv(), ptrace() and sleep(), as sleeps get pretty annoying ...
2
votes
0answers
483 views

Trying to run MIPS ELF with a cross toolchain but sigbus error

I finally successfuly installed a cross toolchain from this site in order to run and debug a mips elf on my x86-64 . I only have the elf file. I can disassemble it but when i try to run it with : ...
1
vote
1answer
211 views

Can PowerPC64 ELF file have 32-bit pointers?

I've been given an ELF binary file which self describes as PowerPC 64-bit. The e_entry field of the ELF header points to the beginning of a section called .opd. According to this specification, it is ...
4
votes
1answer
4k views

How to disassemble/run mips ELF file ? (with readelf error)

So i want to disassemble and then run a MIPS elf file for the first time. As i don't have MIPS hardware i am using mipsel-unknown-linux-gnu toolchain.Here comes the problem. The output of the command ...
1
vote
1answer
517 views

How to load library defined symbols to a specified location?

The test is on Ubuntu 12.04, 32-bit, with gcc 4.6.3. Basically I am doing some binary manipulation work on ELF binaries, and what I have to do now is to assemble a assembly program and guarantee the ...