Questions tagged [elf]
the Executable and Linkable Format is the main executable and object format for Linux, Solaris, *BSD, and many other OSes...
248
questions
4
votes
0
answers
93
views
Any way to edit an ELF binary without hex? [duplicate]
So, this is a noob question, I am a complete beginner in this field, so sorry if I'm wasting your time in any way.
I wanted to know, if there is a way to edit an ELF binary without using a hex editor....
7
votes
1
answer
12k
views
How to export a working elf binary from Ghidra?
When patching a program and then using the export binary function, it turns the elf headers are corrupt.
Is there any way to work around this problem?
-2
votes
1
answer
250
views
DT_DEBUG not filled on dlopen [closed]
A target library "lib42.so" has DT_DEBUG entry in the .dynamic section.
After dlopen("lib42.so", RTLD_LOCAL | RTLD_NOW) succeded, r_debug->d_un.d_ptr is equal to zero. Why?
1
vote
1
answer
907
views
Find functions names in .init_array section in unstripped library
Is it possible to find out all instances of static initialization in a elf dynamic library.
I can dump the array of function pointers in .init_array section via objdump command like this.
objdump -s -...
1
vote
0
answers
2k
views
Finding function call (with arguments) in ELF file
I have two kinds of ELF files, built from C++.
.so files:
ELF 64-bit LSB shared object, x86-64, version 1 (GNU/Linux), dynamically linked, BuildID[sha1]=5e751e769912aef28bc63b888e5e4904b867a180, ...
1
vote
0
answers
235
views
Need help understanding basic buffer overflow
So I have this sample problem that I need to buffer overflow. Its an elf file that require to be run on a separate terminal then using "nc localhost 'port' " on a separate terminal we can see the ...
2
votes
1
answer
163
views
Process Immediately Killed
I'm trying to reverse an ARM executable. It's for an embedded system, but I don't have any details about the normally targeted environment.
Here's what file shows: ELF 32-bit LSB executable, ARM, ...
0
votes
1
answer
282
views
Is it possible to add a label to an ELF executable and then call that label? If so, how?
Let's say we have this simple "hello world" nasm code that will be compiled to an ELF executable:
global main
section .data
message db "Hello World!", 0x00
section .text
main:
call ...
5
votes
1
answer
2k
views
Find function in a stripped dynamic ELF library
Im currently reverse engineering an android app and this app calls a function named "getUserInfo" in an ARM 32bit ELF library called "libcms.so" (from TikTok) via the Java Native Interface.
My ...
3
votes
1
answer
260
views
Enumerating (name, addresses) in PLT of an ELF file without elf.h
I want to show users imported symbols of a given ELF file like this(#1) in a disassembler project.(Android app)
1d21a: f7fa e8e8 blx 173ec ; __android_log_print@plt ...
Currently, I can only show ...
1
vote
2
answers
753
views
Get Multiple Function Names for One Address in IDA
I am trying to get a complete list of symbol names in IDA. All functions that return names operate primarily around looking at particular addresses and there corresponding entries in the symbol table, ...
0
votes
1
answer
422
views
How to identify different memory regions of an elf binary in radare2?
I'm just starting out with reverse engineering, one thing I'm finding difficult is identifying different areas of memory. I'm using radare2, and I would like to be able to easily seek and identify ...
7
votes
2
answers
3k
views
Writing ELF headers in Radare?
Reading Keith Makan's, "Introduction to the ELF Format : The ELF Header", he modifies e_entry,
The e_entry field lists the offset in the file where the program should start executing.Normally it ...
4
votes
3
answers
2k
views
How can I get the byte size of an operand in IDA Pro?
I am trying to get the byte size of all operands in a given instruction from IDA Pro. At first I tried using GetOperandValue(ea,n) to see how large the value was and calculate how many bytes were ...
1
vote
1
answer
488
views
Unable to resolve the symbols for a statically linked binary in IDA Pro
I have a statically linked binary which is stripped. When I load it in IDA Pro, I don't see the function names as expected.
I generated the sig file for libc on the Linux machine on which the program ...
0
votes
1
answer
1k
views
IDA Pro is showing Function names for a Stripped Binary
I have an ELF 32-bit binary and it is a stripped binary.
Yet, when I load with IDA Pro, I can see the function names like write, open, malloc and so on. So, I am trying to understand if the binary is ...
8
votes
2
answers
24k
views
Find base address and memory size of program debugged in gdb
I want to find out the base address and the imagesize of the program being debugged in gdb. As in, where it got loaded in memory. For shared libraries I can do "info sharedlibrary" and I get very ...
5
votes
1
answer
411
views
Importance of Compiler Version in generating a signature
I load a reference elf that I cross-compiled for AArch64 into IDA Pro, idb2pat to generate a .pat which I then process through sigmake.
I then use the signature file (in the appropriate IDA Pro ...
1
vote
0
answers
47
views
Legal Reverse Engineering for Security Review in US for Korean Provided Module
My company has received a command-line stand-alone (ELF) executable from a Korean company that provides a service for validating Korean users. It took them a few tries to get us a version that runs on ...
3
votes
1
answer
1k
views
How can you get the symbol visibility with radare?
I created a quick x86_64 Assembly file with NASM to generate the four different visibility classes for ELF 64. With readelf --symbols I get the Symbol Visibility in the Vis column: DEFAULT, INTERNAL, ...
1
vote
2
answers
6k
views
Can't find the password anywhere in the binary
This is my first post here. I was recently involved in a capture the flag preparation test which involved decompiling an ELF 32-bit LSB executable, Intel 80386 file for Linux compiled with GCC. The ...
3
votes
1
answer
2k
views
ELF - The start address of .got section is different from the entry point address of the GOT(global offset table)
I used readelf to read the information of the ELF file. I found the address of .got section in the section header is different from the GOT entry point address read from the dynamic section. Is the ...
4
votes
1
answer
2k
views
What are the first 16 bytes in .rodata section?
What are the first 16 bytes in the .rodata section?
For example, I have the following code:
#include <cstdio>
void myprintf(const char* ptr) {
printf("%p\n", ptr);
}
int main() {
...
3
votes
2
answers
773
views
What are these LOAD segments in an assembly ELF64?
I wrote the following (fasm) assembly program:
format ELF64 executable
segment readable executable
; sys_exit, sys_write, strlen and print are from io.inc and
; unistd64.inc at: https://github.com/...
1
vote
1
answer
2k
views
IDA - Remote debug on linux
I am trying to debug remotly an ELF from my windows 10 (the ELF runs on my ubuntu 32 bit vm) (the ELF is from pwnable.kr - unlink).
Because the exploit is via gets() I try to pass input through the "...
1
vote
1
answer
2k
views
Radare2 - Insert asm instructions without overwriting
In order to patch a x86 elf file on Linux, I'm struggling to insert a specific assembler instruction into the binary file without overwriting any of the preexisting instructions.
I've been reading ...
1
vote
1
answer
208
views
Why would an ELF SHT_REL section contain relocations outside the section its sh_info refers to?
I have a .so from an Android JNI/NDK application. Here are two of its sections:
[Nr] Name Type Addr Off Size ES Flg Lk Inf Al
[10] .rel.plt REL ...
4
votes
1
answer
121
views
What does a C++ identifier ending in $_## mean?
In trying to understand a .so from an Android game made with Cocos2d-x, I've come across identifiers like the following (after demangling):
SceneActionMap::updateTalkMode(float)::$_37
SceneActionMap::...
1
vote
1
answer
364
views
Unknown Game Client Data
As asking a friend and no amount of Googling yielded an answer, I figured I'd make an account and give this place a go.
I'm working on reverse engineering the server for a relatively old game with no ...
4
votes
1
answer
2k
views
How do I find out what section variables and strings are defined in?
Given a simple program like this,
void main (int argc, char * argv[] ) {
char * arr[] = {"foo", "bar", "baz"};
*(arr[0]) = 'F';
printf( "%s", arr[0] );
}
How do I find out what section ...
7
votes
1
answer
1k
views
Determine if an ELF file is signed or not
I need some help in determining if an ELF file is signed or with a valid signature or not.
I have used the readelf tool with -S option in order to view the section headers and more specifically, the ...
1
vote
0
answers
196
views
Are there tools or plugins for IDA Pro that can find ELF sections?
I'm trying to use data from one ELF to build another ELF, but I can't seem to find anything that gets what I need using IDA Pro. I'm trying to build a database out of Sections, Symbols, and Cross-...
1
vote
1
answer
2k
views
Is IDA resolving ELF relocations correctly?
While working on this kernel module, I noticed IDA somehow resolves some ELF relocations statically. Consider the symbol sys_renameat, which, according to IDA, resides at 0x8000720 in .bss segment.
...
2
votes
1
answer
538
views
Position-independent code dectection
Is it possible to detect whether a given executable is a PIC by looking at the disassembler's output? If not, what are other valid ways to go about this?
1
vote
1
answer
170
views
Build Graph Printable String Information in ELF
I'm new in the field of reverse engineering to detect malicious code in ELF file. I used IDA Pro to retrieve a list of strings in an elf file. But I wonder if IDA can build a graph showing the link ...
1
vote
0
answers
484
views
ELF .text infection test
I'm trying to implement an example of an ELF .text infection as described in "Learning Linux Binary Analysis". I'm currently having a problem where I successfully injected my data into the .text ...
4
votes
3
answers
10k
views
Start analysis at any position in elf is Entry Point?
An entry point is considered to be the first point to be made in a program. So if I start at any position in the program to start analyzing it can be considered an entry point is not ??
please help ...
3
votes
1
answer
750
views
Radare2 create section
Radare2 has S* commands, that can show, delete, modify sections. Is it possible to create new section in executable file and save it?
0
votes
1
answer
2k
views
Parsing .rodata (ELF)
IDA pro is able to display the data contained in the read only data section of ELF files, but the section is defined as type SHT_PROGBITS.
To my knowledge, we cannot parse sections of this type to ...
0
votes
1
answer
465
views
How does IDA create COMMON, ABS and EXTERN segments of ELF-file?
Some symbols (from symbol table) in ELF-file belong to special sections (COMMON, ABS, UNDEF).
IDA creates virtual sections for this symbols.
Subject: What is the rule (or set of rules) which IDA use ...
1
vote
1
answer
4k
views
How to exploit an suid root application
I have to exploit an application and I have only the 32-bit ELF excecutable, which is also stripped. Its a suid root application and when it is executed practically run the ls -al command for a ...
1
vote
1
answer
1k
views
How to find ELF symbol table reference?
In a huge ELF binary, I find some functions which use some kind of (string) constant. The constant itself seems to be stored inside the binary itself but I can't figure out, how to resolve IDA's ...
0
votes
1
answer
568
views
ELF64 Reflective Loading [closed]
I'm looking for an ELF64 reflective loader, so I can download an ELF and execute it without saving to disk?
Is anyone able to point me at one please? Or a clear one for ELF32 so I can translate?
...
1
vote
1
answer
2k
views
How do you compile a C program with missing symbols?
In Learning Linux Binary Analysis by Ryan "elfmaster" O'Neill. On Page 33, the author compiles a program with a symbol reference and no definition,
Let's take a look at the source code:
_start()
...
1
vote
1
answer
3k
views
Elf file format finding .got and .got.plt segments
I'm writing ELF parser and simple disassembler x86. Having code like this
.text:000B5A2A call 0000B470 ;e.g. _glXSwapBuffers
...
...
got.plt:0000B470 jmp dword ptr [ebx+240h] ;jump to ....
5
votes
1
answer
900
views
Difference between 'readelf' and 'radare2' addresses
I have an MIPS binary file that I want to analyze. I am having a little trouble understanding the way elfread and r2 interpret the adressing scheme from a binary.
For example, r2 finds a function ...
1
vote
1
answer
2k
views
objdump -T gives Invalid Operation on MIPS .so
I have a MIPS .so file that I'm trying to reverse. Binary Ninja (too cheap for IDA) finds no symbols, and neither does objdump -T, instead giving "Invalid Operation":
% mips-linux-gnu-objdump -x ...
2
votes
1
answer
655
views
Debugging Binary using Far Ret to switch Code Segment
It appears that GDB is unable to handle binaries which switch code segments.
Using pwntools*, it's trivial to generate a 32-bit intel binary which uses retf to switch to the 64-bit code segment. ...
3
votes
1
answer
9k
views
Address to file offset
I have read st_value from the ELF symbol table, with the value being 4195622. When converted to hex, the value is 400580. I am aware that the file offset is 580 bytes.
My question is how to actually ...
2
votes
1
answer
3k
views
Disassemblers resolving (ELF) section names
I'm working with linux executables and was just wondering how it is that section names are resolved to addresses upon disassembly of an ELF.
For example take some random disassembly output from ...