Questions tagged [elf]

the Executable and Linkable Format is the main executable and object format for Linux, Solaris, *BSD, and many other OSes...

Filter by
Sorted by
Tagged with
0
votes
1answer
8k views

Reverse engineering a golang binary file

I compiled docker by myself with some modifications. I would like to perform some static analysis to the binary. Mostly to see which parts of the code take more memory, etc. It's on linux (elf). Any ...
1
vote
2answers
1k views

IDA Pro - Applying function signatures

I have three files: ELF executable, ELF dynamically linked library (.so), C headers file (.h) with function signatures and related structures for that library. #1 imports a number of functions from #...
1
vote
0answers
269 views

Accessing .rodata/.rel.data.ro

Analyzing an android ELF binary. How/where does something access a specific area of .rodata or .rel.data.ro? Have tried using objdump, rabin2, readelf, etc and I can't seem to figure out how it is ...
-1
votes
1answer
306 views

Practicing what SHOULD be a simple crackme. Program calls strlen() but never returns

I'm trying out a crackme from the "LSE CTF" called "Blue Box" worth only 10 points. I've attempted this inside GDB and radare2... It is very simple, takes one argument and first checks to make sure ...
1
vote
1answer
1k views

ptrace TRACE_PEEKER: Input/output error accessing virtual address contents when traced file is a shared object file

I'm using updated Kali and compiling this for 64- bit Working through Learning Linux Binary Analysis,'simple ptrace-based debugger' on page 57. Source code and testfile to debug included. Problem ...
2
votes
1answer
2k views

IDA Pro debugging: follow child process

I'm reverse engineering a malware that creates a number of child processes and I'm trying to do dynamic analysis of the ELF binary with IDA Pro and IDA's Local Linux Debugger, but I can't get IDA to ...
3
votes
1answer
989 views

Is there a way to debug an elf file that runs with no problems with damaged header?

My question is general, but to have an example to work with, let us take one from Whirlwind Tutorial. ; tiny.asm BITS 32 org 0x00010000 db 0x7F, "ELF" ; ...
2
votes
2answers
3k views

Changing Entrypoint in ELF executable

I wrote some code that does the following: Searches for and finds an offset in a binary file to add code (looks for a sequence of 00s I can overwrite). Then, I change the entrypoint of the ELF to ...
1
vote
1answer
941 views

GNU objcopy: elf to hex missing sections

I am using objcopy to convert elf to hex. When I disassemble the elf in IDA Pro, all the sections are present, but they are missing from my hex and it seems the elf headers: C:\TricoreGCC>tricore-...
3
votes
1answer
7k views

Making changes in ELF file after dissassembly [duplicate]

I am new to reverse engineering and after some research, I haven't found a clear way to do what I want to do. I have an ELF file, but not the original source code that generated it. It is really ...
4
votes
1answer
3k views

Why are symbols with local binding present in the symbol table of my ELF files?

I found out that there are symbols with binding=LOCAL and visibility=HIDDEN in the symbol table (.symtab) of ELF executables/libraries. What are they needed for? They are not involved in the ...
7
votes
1answer
7k views

What is a good and reliable C decompiler that support ELF and SH4 Architecture?

I have a ELF file, which is a partial firmware of a navigation module(my BMW idrive CCC), I need to decompile the elf file. I tried Reko Decompiler which said it does not support SH4 and Snowman ...
1
vote
0answers
438 views

Elf binary manipulation tool on ARM

Do you know any free tool for binary manipulation elf file on ARM, something like ERESI elfsh for Intel? Purpose - adding instructions into existing binary elf file.
0
votes
2answers
8k views

Is it possible to debug an ELF file with a Windows-based disassembler?

Problem : How can I debug an ELF file in MS Windows? is it possible? Scenario : I have an ELF file compiled to work on hardware with VXWorks 5.5 OS and SH4 CPU. IDA68 is able to disassemble the file ...
5
votes
3answers
4k views

How to SUCCESSFULLY add a code section to an executable file in Linux?

I am in Linux, and I have seen this question a few times but never, nobody answered how to really make this work. I need to add a section to an already compiled binary. Lets say for a moment is an ...
1
vote
1answer
4k views

How do I find where a String is referenced in IDA Pro?

Please bear in mind I am very new to all this - however I have searched and could not easily find an answer to my issue. I have an elf (actually an Android aboot image based upon LK) that I loaded ...
1
vote
1answer
1k views

Finding hidden string location using radare2 on ELF binaries

I'm working through some reverse engineering sample programs (IOLI crackmes) crackme0x00 - crackme0x09 which are gcc compiled ELF format binaries. I was provided these by a colleague and can be ...
3
votes
1answer
1k views

Replace section inside ELF file

Is it possible to replace a non-code section inside an ELF file? If so, then how? Is there something I would have to consider before simply replacing the bytes by some other bytes (of course nothing ...
2
votes
0answers
359 views

Using __kernel_vsyscall on x64 linux machine [closed]

I am trying to use __kernel_vsyscall instead of syscall/int 80 on linux x64. I have read that it can be done on Intel chips (I have one), but i can't find how can one do it. I have x32 version: int ...
0
votes
3answers
358 views

What exactly is this piece of assembly code doing?

This assembly is for Intel x86-64 bit, seems to be too baffling to me. How come the jz instruction jump to a non-instruction (0x400AC9)? How come the call invokes a non-existing address? For curious ...
0
votes
1answer
10k views

Debug ELF executable

I cannot load the following executable type in OllyDbg: - ELF 32-bit LSB executable, Intel 80386 Why can OllyDbg not handle this kind of executables? What are good (OllyDbg-like) debuggers to debug ...
1
vote
1answer
575 views

Relocate ELF symbols

How can I apply relocations of symbols in an elffile? I'm currently trying to archive this with pyelftools. Strangely, I could hardly find any information on how to do this, although some projects ...
0
votes
1answer
129 views

how Can I use a linux so file from a program other than the program it was developed for?

I wish to use the codecs that come with realplayer but without needing realplayer. The codecs I want to use are all in .so format, but I don't know how to separate the codecs from the rest of ...
1
vote
1answer
270 views

Is it possible to rebuild an nexe file if I can read at arbitrary untrusted memory addresses?

Ok, I’m in a remote situation where I don’t have access to the remote filesystem but where I can run arbitrary python code (except I can’t fork processes and I don’t have access to ulimit and uname). ...
0
votes
2answers
2k views

Recognize the library functions of statically linked executable file in IDA Pro

Recently I worked on a Linux program which has all of its symbols stripped. Opening it with IDA resulted in none of its functions identified. Thus I tried to extract any usable information from the ...
0
votes
1answer
808 views

Fixing weird no-sections embedded ELF binary for decompilation

I recently stumbled upon a weird binary, complied by a "Qualcomm Hexagon" compiler. The ELF binary seems fine, however section tables (section header size and string table index) seem empty. For those ...
2
votes
2answers
2k views

How to locate module_init() offset from ELF header of Linux kernel module?

The header is self explanatory but to explain myself better. I have an ELF binary - loadable kernel module, compiled with symbols. I want to know how to locate the offset of the module_init() function....
5
votes
2answers
3k views

IDA Load Symbols From Static Library

I have a stripped elf file that has statically linked libraries. Is there a way that I could take the original library files that are in a files and name the functions in IDA that match those in the ...
1
vote
1answer
301 views

Append Code To Text Segment With Global Variables?

I have a powerpc computer that takes ELF files for its code. I have made a tool that allows me to extract and inject segments successfully, but I am missing a small piece of information regarding the ...
1
vote
2answers
166 views

Figure out whether a function has return value of not?

I am doing binary analysis on x86-64bit ELF binaries. All the binaries are compiled from C language. Basically, for a given function, I would like to figure out whether this function has a return ...
0
votes
1answer
222 views

What segment do ELF SHN_COMMON objects get allocated in?

I am trying to understand the contents of an ELF relocatable object (*.o file), which appears to be a Fortran file compiled to SPARC object code. I am looking at the sections below, which all look ...
5
votes
2answers
7k views

Fixing corrupt ELF header field “e_shnum” for use in GDB

If the ELF header which usually can be read using readelf has been manually manipulated, let's say by increasing the value for the "Size of section headers" the binary still can be executed and works ...
1
vote
1answer
3k views

Unable to view stack and memory addresses in IDA Pro [duplicate]

I am debugging a 32-bit ELF executable using remote GDB debugging option of IDA Pro. However, I am unable to view the contents of stack in the stack view. Also, the stack pointer value is: 0xFFFFD328 ...
2
votes
2answers
314 views

Dynamic analysis of malware samples

I have thousands of Linux malware samples in ELF format. And I am thinking to use dynamic analysis (say, PIN) to obtain an execution trace of each malware sample. However, I am afraid such activity ...
3
votes
0answers
290 views

Modern equivalent to rsymtab for reconstructing symbol table for statically linked / stripped binaries?

I'm working with a 32-bit ELF binary that (I believe) has been statically linked against a few different third-party libraries. It has also been stripped, so I don't have much to go on with respect to ...
1
vote
1answer
309 views

Variable liveness analysis on binaries

I want to detect all the variables live at any instruction/address in a binary. By variable, I refer to both global as well as function local variables. In other words, given a Linux ELF and a virtual ...
2
votes
0answers
1k views

Debugging a position independent executable ELF

I am trying to follow the write-up about hackercalc (a challenge for DEFCON 2015 quals). First, by loading the challenge into gdb, I observe that: (gdb) info files ... Entry point: 0xcf8 ... So I ...
2
votes
2answers
2k views

How the dynamic linker determines which routine to call on Linux?

I have a question about dynamic linking on Linux. Consider the following disassembly of an ARM binary. 8300 <printf@plt-0x40>: .... 8320: e28fc600 add ip, pc, #0, 12 8324: e28cca08 ...
4
votes
1answer
2k views

Injecting shellcode in ELF binary

I am trying to inject a piece of shellcode inside a 32-bit ELF executable. I am running Ubuntu 14.04 64-bit. Hence, all the commands I have run require explicit switches to produce 32-bit code. I am ...
2
votes
1answer
2k views

Finding the library an imported function is from in IDA

I'm fairly new to reversing, and I have even less experience with IDA Pro. I am wondering if there is a way to figure out from where an imported function is imported, i.e. a memory location I can find ...
2
votes
1answer
976 views

Insert a function call in an ELF executable

I want to patch an ELF executable to insert a function call (the function s2e_rawmon_loadmodule and its dependencies are to be linked statically, preferably) at the beginning. This answer seems to ...
4
votes
1answer
1k views

Illegal entry point of an ELF file

I have encountered a quite obscure 32-bit ELF file (that is a crackme) and I still cannot figure out how can it execute. First, beside some "understandable" property that it has not any section: # ...
2
votes
2answers
5k views

Where can I get Linux malware samples?

There have been numerous sites stated in this wonderful post that one could retrieve malware samples. However, I am having a difficult time (sorry D:) locating Linux-specific malware from those sites ...
8
votes
3answers
6k views

How can I generate a call graph from an unstripped x86 Linux ELF?

There's a piece of software, for which I only have the binary, not the source code. It's: unobfuscated (so, not polymorphic or anything. It is optimized a bit, though) unstripped x86 32 bit ...
5
votes
1answer
4k views

How to create a IDA FLIRT signature for a PPC library?

I'd like to create a IDA FLIRT signature for the following PPC uClibc library: libuClibc-0.9.15.so: ELF 32-bit MSB shared object, PowerPC or cisco 4500, version 1 (SYSV), dynamically linked, for GNU/...
4
votes
1answer
3k views

ELF: How to make IDA show me the correct PLT (Procedure Linkage Table) content?

I would like to make IDA disassemble the .plt section of ELF files correctly, e.g. as objdump does: objdump -D -M intel asdf | grep "Disassembly of section .plt" -A80 I don't know why but IDA gives ...
24
votes
4answers
31k views

Cross debugging for ARM / MIPS ELF with QEMU/toolchain

as i'm new about cross-debugging and cross-compilation i need some help because i feel so confused. I have a MIPS elf file, [myelf][1] .You can see bellow the output of file myelf: myelf: ELF 32-bit ...
6
votes
1answer
10k views

Which python library for parsing Linux ELF files?

I want to be able to parse 32 and 64 bit ELF files - but not create or modify them (e.g. as discussed in this thread). The ELF binaries may possibly come from embedded Linux systems, that is, the ...
18
votes
3answers
14k views

Set a breakpoint on GDB entry point for stripped PIE binaries without disabling ASLR

Given a position-independent, statically-linked, stripped binary, there does not appear to be a way in GDB to set a breakpoint at the entry point without disabling ASLR. break start and similar ...
2
votes
0answers
508 views

Trying to run MIPS ELF with a cross toolchain but sigbus error

I finally successfuly installed a cross toolchain from this site in order to run and debug a mips elf on my x86-64 . I only have the elf file. I can disassemble it but when i try to run it with : ...