Questions tagged [linux]
A free and open source POSIX compatible operating system with a monolithic kernel and a kernel module system. Originally created by Linus Torvalds.
338
questions
1
vote
1
answer
83
views
Unix system with windows-style registry
When trying to determine the filesystem of a firmware image using binwalk, I encountered a strange combination.
The binwalk is returning a lot of Unix paths, but some of them contain a typical windows-...
0
votes
1
answer
62
views
Updating legacy library in an already compiled binary
I'm dealing with a reverse engineering challenge involving a binary application that was statically compiled with a legacy library. While the legacy library is not vulnerable, it lacks certain ...
- 3
0
votes
1
answer
115
views
Adding a program header to ELF
I am a newbie in this, and I am trying to add a program header to a simple ELF64 "Hello World" program on Ubuntu. All in changing the binary data of the ELF.
I went to the end of the program ...
- 101
0
votes
0
answers
63
views
What are the general steps for reverse engineering a windows SPI driver for linux?
I have a fingerprint reader on my laptop that works under windows that doesn't show up on lsusb. Which means its not connected via USB. Through some digging around, I found out that this specific ...
1
vote
2
answers
184
views
Adding debug symbols with GDB
In CTFs when I'm given some ELF file, it usually wasn't compiled with the -g flag. Is there a way to to somehow edit the file to make it be as if the ELF file was originally compiled with the -g flag?
...
- 141
0
votes
0
answers
35
views
NTFS files with 0 size, filestamp 01/01/1970 and "?" at the beginning of file name not deletable
I tried to backup millions of files from ext4 to an external NTFS drive. It took ages and at the end gave up, the external drive stalled. After a reboot and successful ntfsfix command I wanted to ...
- 21
0
votes
1
answer
146
views
How learn which functions are called in .so library at Android?
I want to learn how listen certain .so files. I mean what is the way to know which fuctions are called which body of code executed in shared library at Android? I just wanted mofify stock camera on my ...
1
vote
0
answers
37
views
What factors affect the base address of a shared object?
I'm looking at a CVE for an old thrift shop router that amounts to a stack based buffer overflow with no NULL characters allowed. I can control the instruction pointer register as well as a few less ...
- 105
1
vote
0
answers
69
views
How to develop an anti-debug library which allow users to debug their own programs but not the library?
I'm going to publish a library which guarded by anti-debug ,(ptrace_trackme for Linux and isDebuggerPresent for windows).
The down side of this library is: users would be abled to debug their own ...
- 81
2
votes
0
answers
169
views
ZTE F670 V1.1.10P3T21 encrypted config.bin
I want to decrypt config.bin
For this I found in cspd
following code
undefined4 CspDBInitPdtInterface(undefined4 *param_1)
{
dbAddCfgItem(0xffff,0,"/userconfig/cfg/db_user_cfg.xml");
...
- 21
2
votes
0
answers
123
views
Booting a Linux kernel ARM64 boot executable Image
I am self learning reverse engineering and working on reversing a firmware image for an unknown ioT device that's running on Zephyr. I have the firmware image (.img file), which returns 'Linux kernel ...
- 21
3
votes
0
answers
40
views
Linux persistance between runs of program but not between reboots
I am working on reverse-engineering a linux program with a function that reads in configuration information from a file, and then passes this information to the program. However, after I fully exit ...
- 31
4
votes
0
answers
159
views
How to assemble back a disassembled Linux kernel?
I have a Linux kernel file and I need to tweak the contents of its corresponding initramfs. I did it in the past for standard distros where kernel and initramfs were separate. However, this specific ...
- 141
3
votes
0
answers
672
views
Problem getting root shell on Ezviz camera
I got a CS-C6N Ezviz camera. My friend gave it to me because he doesn't use it anymore. I was able to get rtsp stream from the camera (but laggy), and I also was able to connect to UART port on the ...
- 249
2
votes
0
answers
344
views
Cannot load libvulkan.so on Linux chroot running on Android while normal Android apps can load it
Environment
First I will give a quick summary of my environment
Device: Samsung Galaxy M20 (m20lte)
SoC: Exynos 7904 (with Mali-G71 GPU)
OS: Android 10 (Stock ROM with root using Magisk)
Kernel: 4.4....
- 249
5
votes
1
answer
147
views
Check if libc.so use tcache
I have ARM libc.so (GLIBC), How can I check if that libc.so used tcache, and what is the value of arena_max?
Can I check that information offline?
- 281
3
votes
0
answers
194
views
Setting a breakpoint on a shared library's decompiled exported function, and making Ghidra actually stop on that function when debugging a client code
I am very new to Ghidra, so please accept my apologies if my question sounds too simple. Despite the poor quality of the Internet in my country, I tried my best to find an answer online before asking ...
- 31
2
votes
1
answer
182
views
How to access files stored in mouse?
I own a Razer Mamba Elite mouse. After plugging it in to the usb port, an software installation window shows up. Basically it's the Razer software to manage device's options such as profiles, macros, ...
- 21
3
votes
0
answers
810
views
Steghide Linux Steganography how to get "Passphrase"
I am currently on Parrot Linux and have an image has a hidden steganographic inside.
I know I need to decode it with Steghide in the Parrot Terminal.
I also know that I will find out what the hidden ...
- 51
3
votes
1
answer
242
views
How can I verify section -> segment mapping for ELFs on linux?
I'm looking at at ELF on linux and I have readelf --segments ./myELF which shows:
Program Headers:
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align
PHDR ...
- 1,830
1
vote
1
answer
204
views
How do I install fail2ban to Zyxel nas326
So I just got Zyxel nas326 and I looked from internet how to protect nas from bruteforce attack and I found that fail2ban can protect my nas.
Then I found that I can't download any programs to nas326. ...
- 31
1
vote
0
answers
44
views
Where can I get source code for ASCII graph parser?
My plan is to see source code graph in vim of doxygen.
I almost use TUI on Linux.
So, Where can I get C, Python based source code for ASCII graph parser?
- 31
0
votes
1
answer
349
views
Output from gcc containing all included source code?
Right now, I'm using a combination of gcc -g and the objdump -S modes to generate assembly code with debug source code interleaved. However, I'm having trouble correlating some of the functions that ...
- 1,016
4
votes
1
answer
171
views
How to debug cfg80211.ko
I have an Linux embedded device that I want to debug the cfg80211.ko
I have full root SSH on that device.
How can I debug cfg80211.ko?
- 281
5
votes
0
answers
282
views
What utilities allow you to debug a process without pausing execution?
I was just reading this answer on StackOverflow, "How can you debug a process using gdb without pausing it?"
The Linux kernel provides some support for this via PTRACE_SEIZE, but gdb doesn'...
- 1,769
2
votes
2
answers
319
views
Examining memory without attaching to the process by using /proc/$PID/mem?
I have a gap in my understanding and tooling. Now I would prefer to use Radare2, but will consider any answer. Let's use this program as an example.
#include <stdio.h>
#include <unistd.h>
...
- 1,769
1
vote
1
answer
70
views
Patching a B(ranch) causes segfault in ARMv7 binary, while the same patch (with JMP) works on x64 binary
Any ideas why trying to patch a ARMv7 binary causes a segfault while basically the same patch on the Win64 version of the software works as expected?
Here is the Win64 version, that works
UPX0:...
- 11
2
votes
0
answers
166
views
What hints can x86 disassembly give as to GCC/G++ compiler version and options?
I've taken an interest to disassembling binaries and attempting to recreate 1:1 source code (logic) in C and C++ compiled with GCC. I say "logic" because this question does not pertain to ...
- 105
2
votes
1
answer
622
views
Load to Ida binary with all of SO
I have a Linux ARM binary with a lot of shared libraries.
Can I load all of them into one IDA instance so that I can easily navigate between functions? For example: functions that the binary calls and ...
- 281
0
votes
1
answer
427
views
Debugging Windows applications on Linux: Hardware watchpoints and backtracing in IDA not working and winedbg hardware watchpoints borderline unusable?
As in the title. Maybe someone has any experience with this. It's a significant impediment when trying to debug Windows applications on Linux. I find hardware watchpoints, in particular, to be ...
- 115
2
votes
0
answers
5k
views
Extracting ZTE F670L router's config.bin file
I want to enable telnet in my router (ZTE F670L V9.0.11P1N20D), So, I backup my router and i have a file config.bin, Size 23.5KB. I fired up kali and when i issue this command:
$ file config.bin
...
- 21
4
votes
1
answer
611
views
How to use linux .debug file with Ghidra
I have an ELF64 binary that comes with *.sym and .debug. From my understanding this is something akin to PDB. While IDA loads it automatically, it fails to process it. I was wondering if Ghidra will ...
- 53
1
vote
1
answer
202
views
Need help identifying this SoC
Does anybody know the manufacturer of this ARM CPU / SoC? I cannot find any information about it. I don't even know what the character in front of “Star” means.
“SAV500D” seems to be the model, the ...
- 25
1
vote
2
answers
807
views
Run a python in command (kali) with "run" on gdb-peda$
While debugging a program under gdb with gdb-peda installed, I need to pass args to the binary using output from something like python.
Why I am not getting AAAAA?
gdb-peda$ b doSomthing
gdb-peda$ run ...
- 21
1
vote
1
answer
2k
views
how to decrypt zte zxhn h108n V2.5.5_VDFT13 config.bin?
I need the root password from my router. I need to change my snr because my provider had lock it at a high value. I try to decrypt my config.bin file but no result. I try first with zte-config-utility
...
- 11
0
votes
0
answers
76
views
How to determine file system or open unknown .img file
I have a .img file which will not mount, open, extract or anything within Windows using either the tools built into Windows 10, WinRAR or 7-Zip, they all return errors.
I'm trying to look at data ...
- 11
1
vote
0
answers
31
views
Using rbreak without import functions
While debugging with GDB I want to break for each function and print the PC register.
rbreak .
define hook-stop
i r $PC
c
end
The problem is that is stop on functions that imported like printf ...
2
votes
0
answers
129
views
Edit Squashfs filesystem in flash memory
I have read Flash memory and analyze with binwalk and find out Squashfs that I can extract with dd and open with unsquashfs .
When I open this FS I want to add some file into this FS and edit some ...
2
votes
0
answers
102
views
How can I determine the bluetooth commands needed to communicate with my smart scale via bluetooth using my computer?
I have a Tanita-BC401 smart scale. This scale pairs with the "My Tanita" app via Bluetooth.
I have enabled the "Bluetooth HCI Snoop Log" developer option in my Android phone and ...
- 21
1
vote
1
answer
2k
views
How can I find out the size of heap allocations?
While I debug with GDB I see the address of a buffer that's located on the heap.
How can I know what is the size of this buffer? Or where (in the code) this buffer was originally allocated?
When I ...
2
votes
0
answers
507
views
Passing a String into a Function With GDB
So, I have a function with the prototype according to GDB:
{std::string (std::string)} 0x56027729e545
<function(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator&...
- 21
1
vote
0
answers
64
views
parallel NAND flash dumped with dd mtd0-12
Hi hope some one can help i have tried dumping nand on a system in u-boot with the dd command so i have mtd0-12 but have now messed up bootloader now i have non booting device/brick. i have tried jtag ...
- 11
0
votes
1
answer
1k
views
Running ELF file built for ARM arhitecture
My goal is to run and debug ELF file (c444) which is compiled for the ARM architecture. I have some experience with x32 and x64 Intel architectures. However, I down know how to proceed with ARM-based ...
- 1
1
vote
0
answers
114
views
Launching Linux kernel on UART serial interface, but can't login because key-mappings change randomly
I am trying to root an old Linux device I have, it uses the CFE bootloader by Broadcom. I know the username and the password, but something really strange happens when I try to login.
I get a prompt ...
- 263
1
vote
1
answer
66
views
How to capture control flow pins on emulated serial port?
I am reverse engineering how a CPS software package communicates to a radio device. I have the basics down, and want to trick the software into thinking COM1 is the radio, when in reality I want to ...
- 271
1
vote
0
answers
74
views
Handle Ioctl call while running with qemu
I am using qemu to emulate a binary like this
qemu -strace XXXXX .
I saw that the first 2 system calls of this process were TCGETS to stdin and stdout. From man pages
Get and set terminal attributes
...
- 21
1
vote
0
answers
282
views
Why IDA debugger keep receiving SIGTRAP or SIGSEGV after set a break-point and then deactivated that break-point
Here's the problem:
I set a breakpoint in IDA debugger
the program stop at the breakpoint
deactivated the breakpoint
IDA keep receiving SIGTRAP or SIGSEGV
( program stop at breakpoint as expected ) :...
- 131
2
votes
0
answers
846
views
Repacking vmlinux into zImage/bzimage
While RE an embedded device I ran into a problem - I need to patch a check in the kernel which has no sources available. Unpacking the kernel and binary-patching went smoothly. However I cannot get ...
- 163
0
votes
1
answer
425
views
How to get the input necessary to get to the end
In short, I have a code that gets an input via stdin. Once it has the input string in memory, it verifies its integrity by calling a function for every condition, and exiting the program if those ...
2
votes
1
answer
148
views
Create Fake Entry in sysfs
I'm targeting a program that tries to open a file in /sys that doesn't exist. Is there a way to create that file so the program continues? (Normally you can't create flies in sysfs.)
- 141