Questions tagged [linux]

A free and open source POSIX compatible operating system with a monolithic kernel and a kernel module system. Originally created by Linus Torvalds.

Filter by
Sorted by
Tagged with
1
vote
1answer
28 views

Create Fake Entry in sysfs

I'm targeting a program that tries to open a file in /sys that doesn't exist. Is there a way to create that file so the program continues? (Normally you can't create flies in sysfs.)
0
votes
0answers
28 views

unix executable Error: Reading 0x1b50 bytes extends past end of file for string table

info on the file it is called ld it is a command for linking elfs called link editor. Does Error: Reading 0x1b50 bytes extends past end of file for string table mean I am missing some kind of offset? ...
1
vote
1answer
38 views

Replacing firmware, Longshine Shinebook

Am wondering how to replace the firmware on a Longshine Shinebook (manual, firmware, more stuff). Assuming I modify the firmware files, how do I put the new version on the device? I'm guessing there ...
2
votes
0answers
24 views

Why PTRACE_POKEDATA returns I/O error?

I learning usage of ptrace. I tried following simple example but raises a I/O Error. I would like to overwrite "Hello, world" (printing string) from other process. A target program prints &...
1
vote
1answer
40 views

What could a firmware image be, if not embedded linux?

I decided to play around with an old baby monitor, purely to learn something about how such things (I.E. embedded devices) work. I successfully extracted the flash memory, and I was expecting this to ...
2
votes
1answer
30 views

Comparing the static address of the vtable of a class, to the pointer to it held by the object

I know this is compiler/ABI dependent, not necessarily standardized, etc. I've always assumed, from what I've read in several places (e.g. an answer here or the example in wikipedia), that a typical ...
0
votes
1answer
50 views

Program goes to suspend when buffer overflow occurs

Full disclosure: I am seeking help to complete a college assignment. I am seeking help on steps where I am stuck and unable to move forward, not a ready made answer. I need to exploit it to get a ...
0
votes
0answers
25 views

Configure Strace do not parse ioctl command

When I run strace strace -fp 123 -o log -e trace="ioctl" I saw ioctl that strace parse the ioctl command , How can I see the number of ioctl command without parsing?
0
votes
0answers
85 views

x64dbg for linux executables?

Is there a x64dbg for Linux executables? I really love x64dbg, but in a lot of CTF challenges there are Linux executables and not .exe files or .dll files.
1
vote
1answer
58 views

Identify strings shared between multiple files from the Linux command line

Given a set of arbitrary files, what's the best way to identify the text strings shared between them (either in all files or a subset of them) from the Linux command line? This would be useful for ...
0
votes
0answers
29 views

How do I debug Linux kernel modules with IDA?

I'm trying to figure out a workflow for analyzing Linux kernel modules. I want to debug the modules and not just view the disassembly, so I came upon this guide for IDA pro: https://www.hex-rays.com/...
0
votes
1answer
63 views

Is it possible to intercept syscalls with a custom code from inside the program?

I have a binary calling syscall with a code not present on the Linux kernel. Is it possible that the binary catches the syscall by itself and handles it on-the-fly? Furthermore, what happens if I call ...
3
votes
1answer
368 views

Huawei HG8245H, can't read some system files

I have modem Echolife HG8245H (V3R016C10S150). I'm using telnet to connect it. I need to read some files from this modem. There's a shell mode I can enter, but it is nerfed badly: SU_WAP>shell ...
1
vote
1answer
51 views

How to split bytes into instructions in binary ELF file for x86

I'm working on a static code injector for ELF files. I need to "steal" some bytes in order to write jump to my code on their place and then execute stolen instructions somewhere in the ...
0
votes
1answer
47 views

Call libc functions from the payload statically injected into ELF binary

I am working on ELF-injector, which given some payload (currently it's an assembly file with .text section only) will inject it into ELF binary. I had related post here. Now I would like to make it ...
0
votes
1answer
30 views

Why would just two bits of the SP be used here?

This is the section of disassembled code in question. It’s from a Linux kernel module compiled for 4.4.16 on ARMv7. ; Registers used: ; - r3 : unsigned long argp 0000005c mov r1, ...
0
votes
0answers
24 views

Ollydbg skippingover breakpoint

I am new to the ollydbg world- I am in the middle of injecting shellcode (created with msfvenom...) into a small PE, and during debugging, I can't get it to halt at the breakpoints I set. If I run the ...
2
votes
2answers
209 views

Where to get started with reverse engineering a usb video device on Windows?

I have a piece of proprietary hardware that I'm trying to reverse engineer and write a cross-platform open-source driver for. This device has an IR camera on it, and it seems to be using the UVC ...
-1
votes
1answer
25 views

can a stdout captured at a parameter to python script

I'm working on a CTF challenge that is find a secret password.This secret password base on the username and password that i input and the hash value had print out after hash calculation and i want to ...
3
votes
1answer
214 views

ELF binary injection

I am currently working on an ELF-injector and my approach is standard: find code cave (long enough sequence of 0's), rewrite it with the instructions I want to execute and then jump back to the start ...
1
vote
1answer
98 views

Does the operating system you use matter?

people recommend windows for reverse engineering, I don't want to install windows as a virtual machine because they are laggy and I already have windows 10 as host, is it possible to use linux vm that ...
1
vote
1answer
54 views

Edit IDA signal handler

In Ida Pro while debugging linux process with gdbserver I got window that show than SIGTRAP has been arrived, I choose to pass it to application. How can I edit that choose now? I want to ignore this ...
0
votes
1answer
174 views

Need help opening a .img file from a camera firmware (trying to get out of the Meari/Zumimall/PPstrong cloud!)

I've got a cloud-based battery powered camera which I'm really hoping to get out of the cloud with, in order to enable RTSP or ONVIF (or something local!). I've managed to get a .bin file. Binwalk ...
1
vote
1answer
120 views

ASLR in Linux Vs Windows

I am quite new in binary exploitation. I am doing a lot of beginners exercise here. I am confused about ASLR. I tried some binary exploitation thing in Linux. It was recommended that I should stop ...
0
votes
0answers
56 views

Exploit education stack-five: trouble getting the shell

Im trying the phoenix vm, challenge stack-five on exploit.education (http://exploit.education/phoenix/stack-five/). I run onto a problem while exploiting a stack overflow. The challenge is run execve('...
2
votes
1answer
271 views

hooking libhoudini on x86 emulator

I'm trying to hook libhoudini to debug an application instruction by instruction using frida but frida not supports it i need a example on how can this be achieved! I'm using a x86 emulator to run arm ...
1
vote
0answers
64 views

Replacing bytes from start of every function with IDA Pro

I want to fix a .plt segment in IDA Pro by replacing 12 bytes from start of every function in the .plt segment with the ones I specify. I want to just make each function return so I'm replacing ...
2
votes
1answer
143 views

Linux keyboard driver windows reverse engineering

I have toshiba portege x30-f laptop with Fn keys not working under linux. I've read some articles about usb drivers reverse engineering, but the keyboard connected not via usb. As I can understand it ...
1
vote
0answers
51 views

Same USB packet (Python/user vs C/kernel) but different result

I'm making a Linux module (my first one) for a closed-source, enclosed (no hardware access) device. Using Wireshark I found what to send and where, so I tried the following command in user space ...
2
votes
2answers
105 views

Newbie problems exploiting a format string vulnerability

I encountered a print format vulnerability challenge in a CTF. I don't know anything about these vulnerabilities, so I'm working my way through Saif El-Sherei's format string exploitation tutorial ...
1
vote
1answer
85 views

I need help reverse engineering my ereader (trying to get into the shell)

I'm trying to reverse engineer my E-Reader. It's a Denver EBO-620. I want to change the off screen image and add my own fonts. With help of Reddit I've managed to log the startup sequence (shown down ...
1
vote
1answer
131 views

Linux Embedded board - Kernel Panic problems

I need to duplicate an old embedded board based on a Yocto-based Linux. I have bought a new board with the same part number and now I need to put the old software in the new board (the new board has ...
0
votes
1answer
59 views

Debug process that use /dev/watchdog

I want to debug a process with gdb into Linux system, but the problem is that process pings /dev/watchdog so when I tried to debug it, it stop the process for longer than the watchdog interval so the ...
-1
votes
2answers
65 views

Is address in program can change

I talking about linux arch. When I open program in Ida (statically ) I can see all instructions address like 0x20da mov r8 r2 When I want use that address to breakpoint (for example with ptrace or ...
1
vote
1answer
265 views

Unpacking, modifying, repacking and flashing a firmware

I've been trying to figure out how to modify the firmware on a DVR I bought for cheap recently. The built in software isn't great and doesn't offer any option for exporting video other than plugging a ...
0
votes
1answer
136 views

Find code executed on button press in Qt5 Linux application

I have an executable of a (rather simple) GUI application on Linux, built in Qt5. I am able to run it, and want to find out what happens internally when I press one of the buttons. I suspect that the ...
0
votes
0answers
112 views

Shellcode execution segfault

I have been trying to exploit simple buffer overflow caused by scanf. I'm working on x86 Linux. The point is to spawn a shell. I sucesfully overwritten return address and jumped into my shellcode. But ...
0
votes
1answer
95 views

How can I debug open source C code for Linux?

I want to debug & reverse engineer open source code such as this project. I usually use CLion to write and debug C code on Linux. I've also used GDB. What steps do I need to take to download a ...
2
votes
4answers
674 views

Endoscope Camera YPC99 - how to stream on linux

I'm trying to stream video from endoscope camera YPC99 on linux PC using the WiFi connection. From what I have found so far the camera is using IP 192.168.1.1. It supports RTSP protocol on port 7070 (...
2
votes
2answers
522 views

Repacking an embedded initramfs

I'd like to modify some of the init scripts in an initramfs that is embedded in a kernel bzImage. I know I can modify them by not changing the size of any files (e.g. by commenting out lines, and ...
1
vote
1answer
208 views

Find all syscall in statically Arm Binary

What is the easy and fast way to find all syscall in statically Arm binary ? Is there any Ida plugin that do that?
2
votes
2answers
101 views

Modern methods of fuzzing/locating heap bugs and potential vulnerabilites

really glad I found this great learning resource. I was wondering, is there any way to fuzz or automate heap vulnerability assesment? I know a lot of practical frameworks for stack based fuzzing in ...
1
vote
0answers
28 views

Format of Alcatel_Lucent I-240W-A backup file

I am trying to modify the backup file of this router in order to change some configurations. Here is the structure I have until now: 16 bytes of the header, zlib compressed xml with the ...
-1
votes
2answers
579 views

How to see assembly of main function?

How can I dump the assembly of main function of binary(not striped) in ubuntu? I want to see the assembly command and the hex value of this command There are 1 binary for arm and 1 binary for x86
0
votes
0answers
50 views

Performing Buffer overflow in Linux

I have buffer overflow in a program i check(it is an array of pointers, and i can overflow the data in the first pointer), but the data i can write is not on the stack, it is on a space the system ...
1
vote
1answer
233 views

Protected shell in embedded linux

When I run telnetd -l /bin/sh on an embedded Linux device and use Putty to telnet to it, the provided shell is /bin/psh (protected shell). On this device, /bin/sh is a symbolic link to /bin/busybox. ...
1
vote
0answers
134 views

IDA shows MEMORY or unknown references on C std library calls (memset, memcpy, etc.)

I'm currently reversing a Linux 32-bit executable (with a statically linked library included in it) but I'm having a little problem I can't find a solution for. Basically whenever I stumble across a ...
0
votes
1answer
32 views

Linux encryption/luks/pymouth password scripts corruption

I noticed that the bootup scripts that collect the password for full disk encryption on linux (fedora-31) were displaying corrupted text. The kind that looked like binary data being printed at text: ...
4
votes
1answer
207 views

The buffer is too short to insert addresses when exploiting buffer overflow

Newbie here. Sorry for what you about to read . I'm currently working on exploiting a binary on Ubuntu 18.04. Here is some information about the binary: Its checksec information using pwntools: ...
2
votes
1answer
329 views

ildasm on Linux: “original” ildasm.exe same as dotnet-ildasm?

I would like to use ildasm on Linux. The original one, that comes with the .NET SDK and can be found on Windows e.g. at c:\Program Files (x86)\Microsoft SDKs\Windows\v8.0A\bin\NETFX 4.0 Tools\. I ...

1
2 3 4 5 6