Questions tagged [elf]

the Executable and Linkable Format is the main executable and object format for Linux, Solaris, *BSD, and many other OSes...

Filter by
Sorted by
Tagged with
4 votes
0 answers
93 views

Any way to edit an ELF binary without hex? [duplicate]

So, this is a noob question, I am a complete beginner in this field, so sorry if I'm wasting your time in any way. I wanted to know, if there is a way to edit an ELF binary without using a hex editor....
InxaneNinja's user avatar
7 votes
1 answer
12k views

How to export a working elf binary from Ghidra?

When patching a program and then using the export binary function, it turns the elf headers are corrupt. Is there any way to work around this problem?
ghidra's user avatar
  • 71
-2 votes
1 answer
250 views

DT_DEBUG not filled on dlopen [closed]

A target library "lib42.so" has DT_DEBUG entry in the .dynamic section. After dlopen("lib42.so", RTLD_LOCAL | RTLD_NOW) succeded, r_debug->d_un.d_ptr is equal to zero. Why?
sqr163's user avatar
  • 99
1 vote
1 answer
907 views

Find functions names in .init_array section in unstripped library

Is it possible to find out all instances of static initialization in a elf dynamic library. I can dump the array of function pointers in .init_array section via objdump command like this. objdump -s -...
Arpit Aggarwal's user avatar
1 vote
0 answers
2k views

Finding function call (with arguments) in ELF file

I have two kinds of ELF files, built from C++. .so files: ELF 64-bit LSB shared object, x86-64, version 1 (GNU/Linux), dynamically linked, BuildID[sha1]=5e751e769912aef28bc63b888e5e4904b867a180, ...
afsantos's user avatar
  • 111
1 vote
0 answers
235 views

Need help understanding basic buffer overflow

So I have this sample problem that I need to buffer overflow. Its an elf file that require to be run on a separate terminal then using "nc localhost 'port' " on a separate terminal we can see the ...
Omar Elgafri's user avatar
2 votes
1 answer
163 views

Process Immediately Killed

I'm trying to reverse an ARM executable. It's for an embedded system, but I don't have any details about the normally targeted environment. Here's what file shows: ELF 32-bit LSB executable, ARM, ...
SArcher's user avatar
  • 141
0 votes
1 answer
282 views

Is it possible to add a label to an ELF executable and then call that label? If so, how?

Let's say we have this simple "hello world" nasm code that will be compiled to an ELF executable: global main section .data message db "Hello World!", 0x00 section .text main: call ...
Arne's user avatar
  • 103
5 votes
1 answer
2k views

Find function in a stripped dynamic ELF library

Im currently reverse engineering an android app and this app calls a function named "getUserInfo" in an ARM 32bit ELF library called "libcms.so" (from TikTok) via the Java Native Interface. My ...
SinOfficial's user avatar
3 votes
1 answer
260 views

Enumerating (name, addresses) in PLT of an ELF file without elf.h

I want to show users imported symbols of a given ELF file like this(#1) in a disassembler project.(Android app) 1d21a: f7fa e8e8 blx 173ec ; __android_log_print@plt ... Currently, I can only show ...
KYHSGeekCode's user avatar
1 vote
2 answers
753 views

Get Multiple Function Names for One Address in IDA

I am trying to get a complete list of symbol names in IDA. All functions that return names operate primarily around looking at particular addresses and there corresponding entries in the symbol table, ...
theTheodidact's user avatar
0 votes
1 answer
422 views

How to identify different memory regions of an elf binary in radare2?

I'm just starting out with reverse engineering, one thing I'm finding difficult is identifying different areas of memory. I'm using radare2, and I would like to be able to easily seek and identify ...
Isaac's user avatar
  • 125
7 votes
2 answers
3k views

Writing ELF headers in Radare?

Reading Keith Makan's, "Introduction to the ELF Format : The ELF Header", he modifies e_entry, The e_entry field lists the offset in the file where the program should start executing.Normally it ...
Evan Carroll's user avatar
  • 1,779
4 votes
3 answers
2k views

How can I get the byte size of an operand in IDA Pro?

I am trying to get the byte size of all operands in a given instruction from IDA Pro. At first I tried using GetOperandValue(ea,n) to see how large the value was and calculate how many bytes were ...
theTheodidact's user avatar
1 vote
1 answer
488 views

Unable to resolve the symbols for a statically linked binary in IDA Pro

I have a statically linked binary which is stripped. When I load it in IDA Pro, I don't see the function names as expected. I generated the sig file for libc on the Linux machine on which the program ...
Neon Flash's user avatar
0 votes
1 answer
1k views

IDA Pro is showing Function names for a Stripped Binary

I have an ELF 32-bit binary and it is a stripped binary. Yet, when I load with IDA Pro, I can see the function names like write, open, malloc and so on. So, I am trying to understand if the binary is ...
Neon Flash's user avatar
8 votes
2 answers
24k views

Find base address and memory size of program debugged in gdb

I want to find out the base address and the imagesize of the program being debugged in gdb. As in, where it got loaded in memory. For shared libraries I can do "info sharedlibrary" and I get very ...
bernd feinman's user avatar
5 votes
1 answer
411 views

Importance of Compiler Version in generating a signature

I load a reference elf that I cross-compiled for AArch64 into IDA Pro, idb2pat to generate a .pat which I then process through sigmake. I then use the signature file (in the appropriate IDA Pro ...
Hi Lo's user avatar
  • 173
1 vote
0 answers
47 views

Legal Reverse Engineering for Security Review in US for Korean Provided Module

My company has received a command-line stand-alone (ELF) executable from a Korean company that provides a service for validating Korean users. It took them a few tries to get us a version that runs on ...
NathanC's user avatar
  • 19
3 votes
1 answer
1k views

How can you get the symbol visibility with radare?

I created a quick x86_64 Assembly file with NASM to generate the four different visibility classes for ELF 64. With readelf --symbols I get the Symbol Visibility in the Vis column: DEFAULT, INTERNAL, ...
Evan Carroll's user avatar
  • 1,779
1 vote
2 answers
6k views

Can't find the password anywhere in the binary

This is my first post here. I was recently involved in a capture the flag preparation test which involved decompiling an ELF 32-bit LSB executable, Intel 80386 file for Linux compiled with GCC. The ...
user avatar
3 votes
1 answer
2k views

ELF - The start address of .got section is different from the entry point address of the GOT(global offset table)

I used readelf to read the information of the ELF file. I found the address of .got section in the section header is different from the GOT entry point address read from the dynamic section. Is the ...
IvanaGyro's user avatar
  • 195
4 votes
1 answer
2k views

What are the first 16 bytes in .rodata section?

What are the first 16 bytes in the .rodata section? For example, I have the following code: #include <cstdio> void myprintf(const char* ptr) { printf("%p\n", ptr); } int main() { ...
HCSF's user avatar
  • 143
3 votes
2 answers
773 views

What are these LOAD segments in an assembly ELF64?

I wrote the following (fasm) assembly program: format ELF64 executable segment readable executable ; sys_exit, sys_write, strlen and print are from io.inc and ; unistd64.inc at: https://github.com/...
Todd's user avatar
  • 31
1 vote
1 answer
2k views

IDA - Remote debug on linux

I am trying to debug remotly an ELF from my windows 10 (the ELF runs on my ubuntu 32 bit vm) (the ELF is from pwnable.kr - unlink). Because the exploit is via gets() I try to pass input through the "...
Shahar Zelig's user avatar
1 vote
1 answer
2k views

Radare2 - Insert asm instructions without overwriting

In order to patch a x86 elf file on Linux, I'm struggling to insert a specific assembler instruction into the binary file without overwriting any of the preexisting instructions. I've been reading ...
programmersn's user avatar
1 vote
1 answer
208 views

Why would an ELF SHT_REL section contain relocations outside the section its sh_info refers to?

I have a .so from an Android JNI/NDK application. Here are two of its sections: [Nr] Name Type Addr Off Size ES Flg Lk Inf Al [10] .rel.plt REL ...
Squ's user avatar
  • 73
4 votes
1 answer
121 views

What does a C++ identifier ending in $_## mean?

In trying to understand a .so from an Android game made with Cocos2d-x, I've come across identifiers like the following (after demangling): SceneActionMap::updateTalkMode(float)::$_37 SceneActionMap::...
Squ's user avatar
  • 73
1 vote
1 answer
364 views

Unknown Game Client Data

As asking a friend and no amount of Googling yielded an answer, I figured I'd make an account and give this place a go. I'm working on reverse engineering the server for a relatively old game with no ...
Acinomatnas's user avatar
4 votes
1 answer
2k views

How do I find out what section variables and strings are defined in?

Given a simple program like this, void main (int argc, char * argv[] ) { char * arr[] = {"foo", "bar", "baz"}; *(arr[0]) = 'F'; printf( "%s", arr[0] ); } How do I find out what section ...
Evan Carroll's user avatar
  • 1,779
7 votes
1 answer
1k views

Determine if an ELF file is signed or not

I need some help in determining if an ELF file is signed or with a valid signature or not. I have used the readelf tool with -S option in order to view the section headers and more specifically, the ...
user9248612's user avatar
1 vote
0 answers
196 views

Are there tools or plugins for IDA Pro that can find ELF sections?

I'm trying to use data from one ELF to build another ELF, but I can't seem to find anything that gets what I need using IDA Pro. I'm trying to build a database out of Sections, Symbols, and Cross-...
theTheodidact's user avatar
1 vote
1 answer
2k views

Is IDA resolving ELF relocations correctly?

While working on this kernel module, I noticed IDA somehow resolves some ELF relocations statically. Consider the symbol sys_renameat, which, according to IDA, resides at 0x8000720 in .bss segment. ...
sherlock's user avatar
  • 1,381
2 votes
1 answer
538 views

Position-independent code dectection

Is it possible to detect whether a given executable is a PIC by looking at the disassembler's output? If not, what are other valid ways to go about this?
Trey's user avatar
  • 417
1 vote
1 answer
170 views

Build Graph Printable String Information in ELF

I'm new in the field of reverse engineering to detect malicious code in ELF file. I used IDA Pro to retrieve a list of strings in an elf file. But I wonder if IDA can build a graph showing the link ...
MrBob's user avatar
  • 69
1 vote
0 answers
484 views

ELF .text infection test

I'm trying to implement an example of an ELF .text infection as described in "Learning Linux Binary Analysis". I'm currently having a problem where I successfully injected my data into the .text ...
Andrew's user avatar
  • 11
4 votes
3 answers
10k views

Start analysis at any position in elf is Entry Point?

An entry point is considered to be the first point to be made in a program. So if I start at any position in the program to start analyzing it can be considered an entry point is not ?? please help ...
MrBob's user avatar
  • 69
3 votes
1 answer
750 views

Radare2 create section

Radare2 has S* commands, that can show, delete, modify sections. Is it possible to create new section in executable file and save it?
Scher Khan's user avatar
0 votes
1 answer
2k views

Parsing .rodata (ELF)

IDA pro is able to display the data contained in the read only data section of ELF files, but the section is defined as type SHT_PROGBITS. To my knowledge, we cannot parse sections of this type to ...
Marius.pharoe's user avatar
0 votes
1 answer
465 views

How does IDA create COMMON, ABS and EXTERN segments of ELF-file?

Some symbols (from symbol table) in ELF-file belong to special sections (COMMON, ABS, UNDEF). IDA creates virtual sections for this symbols. Subject: What is the rule (or set of rules) which IDA use ...
prusanov's user avatar
  • 171
1 vote
1 answer
4k views

How to exploit an suid root application

I have to exploit an application and I have only the 32-bit ELF excecutable, which is also stripped. Its a suid root application and when it is executed practically run the ls -al command for a ...
John Rewei's user avatar
1 vote
1 answer
1k views

How to find ELF symbol table reference?

In a huge ELF binary, I find some functions which use some kind of (string) constant. The constant itself seems to be stored inside the binary itself but I can't figure out, how to resolve IDA's ...
oxident's user avatar
  • 25
0 votes
1 answer
568 views

ELF64 Reflective Loading [closed]

I'm looking for an ELF64 reflective loader, so I can download an ELF and execute it without saving to disk? Is anyone able to point me at one please? Or a clear one for ELF32 so I can translate? ...
user7282391's user avatar
1 vote
1 answer
2k views

How do you compile a C program with missing symbols?

In Learning Linux Binary Analysis by Ryan "elfmaster" O'Neill. On Page 33, the author compiles a program with a symbol reference and no definition, Let's take a look at the source code: _start() ...
Evan Carroll's user avatar
  • 1,779
1 vote
1 answer
3k views

Elf file format finding .got and .got.plt segments

I'm writing ELF parser and simple disassembler x86. Having code like this .text:000B5A2A call 0000B470 ;e.g. _glXSwapBuffers ... ... got.plt:0000B470 jmp dword ptr [ebx+240h] ;jump to ....
krusty's user avatar
  • 367
5 votes
1 answer
900 views

Difference between 'readelf' and 'radare2' addresses

I have an MIPS binary file that I want to analyze. I am having a little trouble understanding the way elfread and r2 interpret the adressing scheme from a binary. For example, r2 finds a function ...
Fulcrum's user avatar
  • 53
1 vote
1 answer
2k views

objdump -T gives Invalid Operation on MIPS .so

I have a MIPS .so file that I'm trying to reverse. Binary Ninja (too cheap for IDA) finds no symbols, and neither does objdump -T, instead giving "Invalid Operation": % mips-linux-gnu-objdump -x ...
David's user avatar
  • 285
2 votes
1 answer
655 views

Debugging Binary using Far Ret to switch Code Segment

It appears that GDB is unable to handle binaries which switch code segments. Using pwntools*, it's trivial to generate a 32-bit intel binary which uses retf to switch to the 64-bit code segment. ...
Zach Riggle's user avatar
  • 2,337
3 votes
1 answer
9k views

Address to file offset

I have read st_value from the ELF symbol table, with the value being 4195622. When converted to hex, the value is 400580. I am aware that the file offset is 580 bytes. My question is how to actually ...
Marius.pharoe's user avatar
2 votes
1 answer
3k views

Disassemblers resolving (ELF) section names

I'm working with linux executables and was just wondering how it is that section names are resolved to addresses upon disassembly of an ELF. For example take some random disassembly output from ...
Marius.pharoe's user avatar