Questions tagged [linux]

A free and open source POSIX compatible operating system with a monolithic kernel and a kernel module system. Originally created by Linus Torvalds.

Filter by
Sorted by
Tagged with
1 vote
0 answers
18 views

Load to Ida binary with all of SO

I have Linux Arm binary with lot of share libraries. Can I load all of them to one Ida so I can easily negative between functions? For example functions that the binary call and implement in on of ...
user avatar
0 votes
1 answer
22 views

Debugging Windows applications on Linux: Hardware watchpoints and backtracing in IDA not working and winedbg hardware watchpoints borderline unusable?

As in the title. Maybe someone has any experience with this. It's a significant impediment when trying to debug Windows applications on Linux. I find hardware watchpoints, in particular, to be ...
user avatar
  • 115
0 votes
0 answers
105 views

Extracting ZTE F670L router's config.bin file

I want to enable telnet in my router (ZTE F670L V9.0.11P1N20D), So, I backup my router and i have a file config.bin, Size 23.5KB. I fired up kali and when i issue this command: $ file config.bin ...
user avatar
0 votes
0 answers
32 views

Linux-based head unit: getting access to displays without any display server?

Overview I have a 2016 Infiniti Q50, which was equipped with an infotainment system called Infiniti InTouch. It consists of two displays (upper and lower), and I have spent the past few weeks reverse ...
user avatar
3 votes
1 answer
60 views

How to use linux .debug file with Ghidra

I have an ELF64 binary that comes with *.sym and .debug. From my understanding this is something akin to PDB. While IDA loads it automatically, it fails to process it. I was wondering if Ghidra will ...
user avatar
  • 33
1 vote
1 answer
102 views

Need help identifying this SoC

Does anybody know the manufacturer of this ARM CPU / SoC? I cannot find any information about it. I don't even know what the character in front of “Star” means. “SAV500D” seems to be the model, the ...
user avatar
0 votes
0 answers
41 views

How to Add Custom Functions to a Dynamic Library

There is a dynamic library elf/so in which I rewrote several functions to the ones I needed (using the id pro, I wrote my functions in place of the original ones - which are not needed). Now I need to ...
user avatar
0 votes
2 answers
127 views

Run a python in command (kali) with "run" on gdb-peda$

While debugging a program under gdb with gdb-peda installed, I need to pass args to the binary using output from something like python. Why I am not getting AAAAA? gdb-peda$ b doSomthing gdb-peda$ run ...
user avatar
  • 11
0 votes
0 answers
283 views

how to decrypt zte zxhn h108n V2.5.5_VDFT13 config.bin?

I need the root password from my router. I need to change my snr because my provider had lock it at a high value. I try to decrypt my config.bin file but no result. I try first with zte-config-utility ...
user avatar
  • 1
0 votes
0 answers
15 views

Freescale MCIMX27VOP4A Boot Loop Problem

My post refers to a product from Gira. More precisely the tks-ip gateway. The gateway transmits the audio/video signals of the door intercom to the local network. Since a power failure, the gateway ...
user avatar
0 votes
0 answers
35 views

How to determine file system or open unknown .img file

I have a .img file which will not mount, open, extract or anything within Windows using either the tools built into Windows 10, WinRAR or 7-Zip, they all return errors. I'm trying to look at data ...
user avatar
0 votes
0 answers
36 views

Unable to redirect program because function address is not correctly written to the heap

I have a heap overflow example program (heap0.c)compiled as follows: gcc heap0.c -w -g -no-pie -z execstack -o heap0 In order to overwrite the instruction pointer with (BBBB = \x42\x42\x42\x42), I ...
user avatar
1 vote
0 answers
24 views

Using rbreak without import functions

While debugging with GDB I want to break for each function and print the PC register. rbreak . define hook-stop i r $PC c end The problem is that is stop on functions that imported like printf ...
user avatar
1 vote
0 answers
41 views

Edit Squashfs filesystem in flash memory

I have read Flash memory and analyze with binwalk and find out Squashfs that I can extract with dd and open with unsquashfs . When I open this FS I want to add some file into this FS and edit some ...
user avatar
1 vote
0 answers
37 views

How can I determine the bluetooth commands needed to communicate with my smart scale via bluetooth using my computer?

I have a Tanita-BC401 smart scale. This scale pairs with the "My Tanita" app via Bluetooth. I have enabled the "Bluetooth HCI Snoop Log" developer option in my Android phone and ...
user avatar
0 votes
0 answers
37 views

How to record all the "call instructions" for a brief interval?

I want to find the GUI push buttons callback function address (Qt app). I am thinking of recording all the call instructions during the short duration it takes to click the button and inspect all of ...
user avatar
1 vote
1 answer
133 views

How can I find out the size of heap allocations?

While I debug with GDB I see the address of a buffer that's located on the heap. How can I know what is the size of this buffer? Or where (in the code) this buffer was originally allocated? When I ...
user avatar
1 vote
0 answers
110 views

Passing a String into a Function With GDB

So, I have a function with the prototype according to GDB: {std::string (std::string)} 0x56027729e545 <function(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator&...
user avatar
  • 11
1 vote
0 answers
32 views

parallel NAND flash dumped with dd mtd0-12

Hi hope some one can help i have tried dumping nand on a system in u-boot with the dd command so i have mtd0-12 but have now messed up bootloader now i have non booting device/brick. i have tried jtag ...
user avatar
0 votes
1 answer
224 views

Running ELF file built for ARM arhitecture

My goal is to run and debug ELF file (c444) which is compiled for the ARM architecture. I have some experience with x32 and x64 Intel architectures. However, I down know how to proceed with ARM-based ...
user avatar
1 vote
0 answers
45 views

Launching Linux kernel on UART serial interface, but can't login because key-mappings change randomly

I am trying to root an old Linux device I have, it uses the CFE bootloader by Broadcom. I know the username and the password, but something really strange happens when I try to login. I get a prompt ...
user avatar
1 vote
1 answer
29 views

How to capture control flow pins on emulated serial port?

I am reverse engineering how a CPS software package communicates to a radio device. I have the basics down, and want to trick the software into thinking COM1 is the radio, when in reality I want to ...
user avatar
1 vote
0 answers
43 views

Handle Ioctl call while running with qemu

I am using qemu to emulate a binary like this qemu -strace XXXXX . I saw that the first 2 system calls of this process were TCGETS to stdin and stdout. From man pages Get and set terminal attributes ...
user avatar
1 vote
0 answers
72 views

Why IDA debugger keep receiving SIGTRAP or SIGSEGV after set a break-point and then deactivated that break-point

Here's the problem: I set a breakpoint in IDA debugger the program stop at the breakpoint deactivated the breakpoint IDA keep receiving SIGTRAP or SIGSEGV ( program stop at breakpoint as expected ) :...
user avatar
0 votes
0 answers
48 views

Linux allocator and heap exploitation

I have some internal questions regarding linux allocator and heap exploitation: Is there a technique/techniques to discover the type of the memory allocator in linux(for example: dlmalloc/ptmalloc/...
user avatar
1 vote
0 answers
286 views

Repacking vmlinux into zImage/bzimage

While RE an embedded device I ran into a problem - I need to patch a check in the kernel which has no sources available. Unpacking the kernel and binary-patching went smoothly. However I cannot get ...
user avatar
  • 153
0 votes
1 answer
157 views

How to get the input necessary to get to the end

In short, I have a code that gets an input via stdin. Once it has the input string in memory, it verifies its integrity by calling a function for every condition, and exiting the program if those ...
user avatar
1 vote
1 answer
51 views

Create Fake Entry in sysfs

I'm targeting a program that tries to open a file in /sys that doesn't exist. Is there a way to create that file so the program continues? (Normally you can't create flies in sysfs.)
user avatar
  • 131
0 votes
0 answers
327 views

unix executable Error: Reading 0x1b50 bytes extends past end of file for string table

info on the file it is called ld it is a command for linking elfs called link editor. Does Error: Reading 0x1b50 bytes extends past end of file for string table mean I am missing some kind of offset? ...
user avatar
1 vote
1 answer
54 views

Replacing firmware, Longshine Shinebook

Am wondering how to replace the firmware on a Longshine Shinebook (manual, firmware, more stuff). Assuming I modify the firmware files, how do I put the new version on the device? I'm guessing there ...
user avatar
  • 133
2 votes
0 answers
98 views

Why PTRACE_POKEDATA returns I/O error?

I learning usage of ptrace. I tried following simple example but raises a I/O Error. I would like to overwrite "Hello, world" (printing string) from other process. A target program prints &...
user avatar
1 vote
1 answer
69 views

What could a firmware image be, if not embedded linux?

I decided to play around with an old baby monitor, purely to learn something about how such things (I.E. embedded devices) work. I successfully extracted the flash memory, and I was expecting this to ...
user avatar
2 votes
1 answer
82 views

Comparing the static address of the vtable of a class, to the pointer to it held by the object

I know this is compiler/ABI dependent, not necessarily standardized, etc. I've always assumed, from what I've read in several places (e.g. an answer here or the example in wikipedia), that a typical ...
user avatar
0 votes
1 answer
62 views

Program goes to suspend when buffer overflow occurs

Full disclosure: I am seeking help to complete a college assignment. I am seeking help on steps where I am stuck and unable to move forward, not a ready made answer. I need to exploit it to get a ...
user avatar
1 vote
1 answer
89 views

Identify strings shared between multiple files from the Linux command line

Given a set of arbitrary files, what's the best way to identify the text strings shared between them (either in all files or a subset of them) from the Linux command line? This would be useful for ...
user avatar
0 votes
1 answer
148 views

Is it possible to intercept syscalls with a custom code from inside the program?

I have a binary calling syscall with a code not present on the Linux kernel. Is it possible that the binary catches the syscall by itself and handles it on-the-fly? Furthermore, what happens if I call ...
user avatar
  • 3
3 votes
1 answer
1k views

Huawei HG8245H, can't read some system files

I have modem Echolife HG8245H (V3R016C10S150). I'm using telnet to connect it. I need to read some files from this modem. There's a shell mode I can enter, but it is nerfed badly: SU_WAP>shell ...
user avatar
1 vote
1 answer
69 views

How to split bytes into instructions in binary ELF file for x86

I'm working on a static code injector for ELF files. I need to "steal" some bytes in order to write jump to my code on their place and then execute stolen instructions somewhere in the ...
user avatar
0 votes
1 answer
86 views

Call libc functions from the payload statically injected into ELF binary

I am working on ELF-injector, which given some payload (currently it's an assembly file with .text section only) will inject it into ELF binary. I had related post here. Now I would like to make it ...
user avatar
0 votes
1 answer
37 views

Why would just two bits of the SP be used here?

This is the section of disassembled code in question. It’s from a Linux kernel module compiled for 4.4.16 on ARMv7. ; Registers used: ; - r3 : unsigned long argp 0000005c mov r1, ...
user avatar
  • 137
2 votes
2 answers
513 views

Where to get started with reverse engineering a usb video device on Windows?

I have a piece of proprietary hardware that I'm trying to reverse engineer and write a cross-platform open-source driver for. This device has an IR camera on it, and it seems to be using the UVC ...
user avatar
-1 votes
1 answer
32 views

can a stdout captured at a parameter to python script

I'm working on a CTF challenge that is find a secret password.This secret password base on the username and password that i input and the hash value had print out after hash calculation and i want to ...
user avatar
  • 1
4 votes
1 answer
693 views

ELF binary injection

I am currently working on an ELF-injector and my approach is standard: find code cave (long enough sequence of 0's), rewrite it with the instructions I want to execute and then jump back to the start ...
user avatar
1 vote
1 answer
205 views

Does the operating system you use matter?

people recommend windows for reverse engineering, I don't want to install windows as a virtual machine because they are laggy and I already have windows 10 as host, is it possible to use linux vm that ...
user avatar
  • 13
1 vote
1 answer
195 views

Edit IDA signal handler

In Ida Pro while debugging linux process with gdbserver I got window that show than SIGTRAP has been arrived, I choose to pass it to application. How can I edit that choose now? I want to ignore this ...
user avatar
  • 11
0 votes
1 answer
327 views

Need help opening a .img file from a camera firmware (trying to get out of the Meari/Zumimall/PPstrong cloud!)

I've got a cloud-based battery powered camera which I'm really hoping to get out of the cloud with, in order to enable RTSP or ONVIF (or something local!). I've managed to get a .bin file. Binwalk ...
user avatar
  • 455
2 votes
2 answers
229 views

ASLR in Linux Vs Windows

I am quite new in binary exploitation. I am doing a lot of beginners exercise here. I am confused about ASLR. I tried some binary exploitation thing in Linux. It was recommended that I should stop ...
user avatar
2 votes
1 answer
437 views

hooking libhoudini on x86 emulator

I'm trying to hook libhoudini to debug an application instruction by instruction using frida but frida not supports it i need a example on how can this be achieved! I'm using a x86 emulator to run arm ...
user avatar
  • 73
1 vote
0 answers
105 views

Replacing bytes from start of every function with IDA Pro

I want to fix a .plt segment in IDA Pro by replacing 12 bytes from start of every function in the .plt segment with the ones I specify. I want to just make each function return so I'm replacing ...
user avatar
  • 73
2 votes
1 answer
180 views

Linux keyboard driver windows reverse engineering

I have toshiba portege x30-f laptop with Fn keys not working under linux. I've read some articles about usb drivers reverse engineering, but the keyboard connected not via usb. As I can understand it ...
user avatar
  • 21

1
2 3 4 5
7