Questions tagged [linux]

A free and open source POSIX compatible operating system with a monolithic kernel and a kernel module system. Originally created by Linus Torvalds.

Filter by
Sorted by
Tagged with
1
vote
1answer
50 views

Why have two symbols tables?

Why have two symbol tables if .symtab already contains everything that's in .dynsym ?
2
votes
2answers
71 views

How can I pass input to my program while debugging it with IDA

I have a program that waits for the user to enter a string input, how can I enter that string input while debugging my program with IDA?
4
votes
2answers
88 views

Can i trap SIGSEGV (on a linux) and what are are the conditions to make it works ? (for a crackme)

Friendly greetings ! I'm writing some crackmes.one challenge and i want to write a challenge where the solution appears on a segmentation fault. (And you have to disassemble the code to find a way ...
-1
votes
0answers
30 views

ZTE config.bin problem

I got this config.bin file out of my ZTE H168N v3.1 Router in order to change the ppoe @xx.xx to make it work on other ISP since it's locked so i used RouterPassView v1.81 to decrypt the config file, ...
1
vote
1answer
48 views

Unexpected SEGFAULT when there's apparently nothing that would cause it

This is a from a CTF problem I'm working on. Hopefully it's appropriate to ask this question here. Above is the GDB output when the segfault goes off. movaps is the offending instruction, meaning ...
0
votes
1answer
60 views

Understand what Ioctl do

I looking in ida on arm linux binary . I can see there that there is ioctl call ioctl(fd,req,num). fd is fd to /dev/module. ,req is some 4bytes and num is some number. How can I understand what ...
1
vote
1answer
118 views

Changing entry-point of and ELF file

I'm trying to conduct a little experiment which basically consists of changing the EP of an ELF file and executing an exit(9) syscall, without returning to the OEP. As shown in the image everything ...
1
vote
1answer
37 views

Find out if address store in heap or stack

While dynamic debugging with ida and gdb-server on binary file running on linux , I saw address that store some value. How can I know if this address allocated in stack or in heap?
1
vote
0answers
62 views

Sniffing TCP packets using Wireshark

I am trying to reverse engineer a decoder. The decoder contains a web server that makes sending/receiving information through the Internet possible. To do so I need to sniff the packets that the ...
0
votes
0answers
31 views

IDA remote debugging - non printable characters in parameters

I am trying to remote debug a certain binary which gets user-specified command line arguments, which can be non-printable of course. My goal is the ability to debug with IDA the process with the ...
2
votes
1answer
144 views

Help needed to extract u-boot kernel & rootfs - nxp lpc 3143 processor

I have a board where in principle aim at emulating a DVD-ROM loading iso file from a drive. This board is running a ARM CPU with 32MB of ram and has no vga output. The firmware update comes with 2 ...
0
votes
0answers
17 views

Stack trace with GdbServer

When I debug binary file on linux with gdbServer with Ida ,I don't see stack trace. Why? How can I fix it to see stack trace??
1
vote
1answer
116 views

Lipo alternate for linux

Currently, I'm using lipo tool to extract the arch type from a fat iOS binary on a Mac OS. Now, I want to do the same on the linux platform for the iOS binaries, i.e. extract a given arch type from a ...
1
vote
0answers
64 views

Decrypt ibt.sfi linux firmware(Intel Wireless 8265 Linux Bluetooth)

Why I want to decrypt: Intel 8265 Bluetooth is likely a RAMUSB device, which needs system to update firmware. I try to transplant this linux firmware to macOS. Problems I met: The macOS BT firmware ...
0
votes
1answer
32 views

What is causing \r\n in libnotify? [closed]

I am trying to look under the hood of libnotify, and ran strace notify-send 'hello' and one of the system calls is: sendto(5, "AUTH\r\n", 6, MSG_NOSIGNAL, NULL, 0) = 6 Surrounded by a: sendmsg(5, {...
1
vote
1answer
97 views

Fork and Waitpid calls in a CTF linux binary

I'm doing one of my first linux crackmes. In the first blocks of code, it goes inside some anti-debug routine and inside one of those it forks and after it calls a waitpid routine. I can verify it ...
1
vote
1answer
106 views

why saved rip changed by push?

I am doing a reverse homework. see the following pictures: as can be seen from this picture, before call push touch3, "saved rip" is at 0x5561dca8, which is equal to the current rsp(0x5561dca8). ...
1
vote
0answers
560 views

OTOOL alternative for linux

I have a reverse engineering set up on a Mac machine. This set up does some reverse engineering on iOS applications(.ipa files). I'm migrating the setup from Mac to a linux machine. Currently on Mac, ...
0
votes
1answer
55 views

Significance of link address 2000 8000 7C00;

Can you explain to me the significance of link address 2000 8000 7C00? It's in a MACRO from the GRUB configure script, which checks whether OBJCOPY works for absolute addresses. Here's the snippet ...
2
votes
1answer
71 views

Process Immediately Killed

I'm trying to reverse an ARM executable. It's for an embedded system, but I don't have any details about the normally targeted environment. Here's what file shows: ELF 32-bit LSB executable, ARM, ...
1
vote
1answer
54 views

Unknown parameters in custom signal handler on Linux

0x0000000008001946: mov 0xa8(%rdx),%rax 0x000000000800194d: lea 0x28(%rdx),%rsi 0x0000000008001951: lea 0x2(%rax),%rdi 0x0000000008001955: add $0xe,%rax 0x0000000008001959: ...
0
votes
1answer
55 views

Remote debugger for Linux from one VM (IDA) to another (running the debuggee)

I want to debug a Linux program (ELF), but my IDA Pro is on a Windows 10 VM and I want to use remote debugging to debug the program on Ubuntu (also in a VM). So, is it possible to debug if both ...
0
votes
1answer
96 views

How do I go about overriding a function internally defined in a binary on Linux?

To be specific, I cannot recompile this binary, nor do I have access to the sourcecode. The functions are not defined within a shared library. So, how can I go about changing a function, or ...
2
votes
2answers
139 views

Step Over not working in GDB

In the function below, let's say EIP is 0x400688. Now, I want to step over the call instead of stepping inside the subroutine. 0x40067a <main+4> sub $0x20,%rsp ...
5
votes
1answer
303 views

How does API call work on Android (NDK)?

In windows platform, an application usually references its IAT(Import Access Table) to get the address of the APIs it wants, then call it. Then some mechanisms are done as demonstrated here nicely. ...
1
vote
1answer
124 views

Question regarding ASLR

If I have a binary file which does not have ASLR enabled. However, the libc file it uses has ASLR enabled, then will the address of system() in libc file be randomized every time? Or the address will ...
0
votes
1answer
143 views

mprotect syscall not working

I want to modify the protection of the .text segment to RWX using a shellcode. In the shellcode, I can issue the syscall for mprotect however it's not working. Per the sys_mprotect definition, it ...
0
votes
1answer
73 views

Linux Assembly Syscall

I'm learning how to write shellcode by using Linux system call "execve" to spawn a shell with root access privilege. Here i found a shellcode online: http://shell-storm.org/shellcode/files/shellcode-...
0
votes
0answers
280 views

Executing MIPS binaries on Ubuntu Linux

I have a 32-bit MIPS binary and I'm trying to execute it on Ubuntu 64-bit. file command for the binary shows: bin: ELF 32-bit MSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), dynamically linked (...
1
vote
1answer
839 views

What does fs and gs registers provide in Linux?

In a 64 bit ELF binary I found it mainly uses fs register to get some values. How can I know which value it wants to access? I'm familiar with that NT kernel uses fs and gs register for TEB structure ...
0
votes
1answer
381 views

IDA remote linux Debugger attach to a running process

I usually use remote linux debugger as shown below: ./linux_server bin And in IDA Pro, I select Remote Linux Debugger as the debugger and set the process options accordingly with the IP address and ...
1
vote
0answers
258 views

Reverse Engineering Linux Core Dump

I have a Linux Core Dump file for a binary (which apparently crashed during execution) file command on the core dump: core.123: ELF 64-bit LSB core file x86-64, version 1 (SYSV), SVR4-style, from '/...
0
votes
1answer
110 views

Changing local variable in caller from callee in C?

I'm implementing a function which is going to perform some time-consuming task, and I'd like to hack the benchmarking part a bit by changing the variable indicating the CPU time my function has ...
3
votes
2answers
154 views

Remote Debugging Linux Binaries - Stack Address Changes?

Do stack addresses change every time we remotely debug a Linux binary using linux_server and IDA Pro? I am using IDA Pro and remote debug a linux binary which is running on a Linux machine and I am ...
1
vote
0answers
264 views

Passing input to program in Remote Debugging with IDA Pro

I am writing an exploit for a binary on Linux using IDA Pro. This binary, first accepts an input using getchar() and after few more code sections, it accepts a buffer as an input through stdin and it ...
1
vote
0answers
637 views

Unable to install ltrace on Kali [closed]

I am kind of stuck with the installation of ltrace on my Kali VM. My /etc/apt/sources.list file is updated with following entry: deb http://http.kali.org/kali kali-rolling main non-free contrib I ...
2
votes
1answer
298 views

Radare2 webui - need help setting it up

How can you set up Radare2 webui in Kali or Ubuntu or any other OS? I've tried so many different methods but none of them have worked so far. I think both of them are debian based so that might be ...
4
votes
2answers
246 views

Extracted router file execution

I am trying to run an executable file that I dug out from an extracted file system of a DSL modem router. So first of all I needed to either have a MIPS Linux box or take the emulation path. After ...
0
votes
2answers
795 views

How to know the arguments of a Linux syscall?

To my knowledge, this is a decent resource to know the parameters of a Linux syscall. However, this only lists 32 bit syscalls, not the 64 bit ones. Moreover, the reference doesn't say which register ...
2
votes
1answer
49 views

Correct my understanding on a basic allocation memory

Here is the function If I understand correctly: There is a buffer of size 256 bytes created (malloc) in this buffer, the first 32 bits are set to 0 (because dword designates 32bits size) the next 32 ...
2
votes
2answers
409 views

How to dump a firmware from an old cell phone with Linux?

I have a "MiracleBox" software for GSM repairing and and old cell phone (Wiko Lubi 4) with a RD8851CL chip inside. With this MiracleBox running on Windows I can make a dump of this chip without ...
2
votes
1answer
481 views

extract zImage from MS-DOS executable

I have an aarch64 kernel image with the following magic number: root@localhost:/# cat msImage|xxd -l4 00000000: 4d5a 0091 MZ.. root@localhost:/# file msImage ...
0
votes
2answers
260 views

How to interpret disassembled MIPS code?

I have disassembled MIPS binary with raw opcodes. How to interpret, for example, these lines: Disassembly of section .data: 00000000 <.data>: ... ... f864: 30a5ffff sd ra,-23248(...
2
votes
1answer
167 views

Cannot open '/proc/…/maps': No such file or directory in radare2 debug mode

When I try to load a program to radare2 debug mode, most of the time I get the following error: $sudo r2 -d a.out Hello world!= attach 2851 2851 Cannot open '/proc/2851/maps': No such file or ...
1
vote
0answers
111 views

Immunity error BB010002

I am trying to make this exploit work and having some difficulty. So I skipped to a 'fixed' version of it from here and the only thing I changed was the shell code: https://github.com/cokebottle/oscp-...
2
votes
0answers
252 views

Obscure router refuses to flash OpenWrt

This is a very obscure Chinese router from a brand called Wavlink. It's the Model: WN529R2/WN529R2P. It's web interface was pretty limited and wouldn't allow firmware modifications. I found GND/Tx/Rx/...
3
votes
1answer
782 views

Radare2 debugging - How to get into lazy imported functions?

I have a linux binary that imports functions from an external library (shared object). The functions are lazy loaded and not available when rip is at @main or @entry. When i step into such a function (...
-1
votes
1answer
448 views

Dynamic Analysis on ELF using IDA

On Linux, while generally reversing ELF files and dynamic analyzing (like step into, step over, break-point, inspecting registers value, memory etc) I use gdb or radare2 which provides dynamic ...
-2
votes
2answers
135 views

Looking for reverse engneer online course [duplicate]

I looking for online reverse engeneer course. Course that study ida,reverse and patch for windows/ linux. Working with ida and another tool. I like many videos lesons. Do you know one?
0
votes
2answers
1k views

Adding additional language to Linux based Firmware of Volkswagen Car Radio

I'm owning a CarPlay head unit from Volkswagen called RCD330 plus. It is possible to upgrade/downgrade to any available firmwares. For example here are two firmware versions: http://rcd330plus.com/rcd/...