Questions tagged [linux]
A free and open source POSIX compatible operating system with a monolithic kernel and a kernel module system. Originally created by Linus Torvalds.
330
questions
1
vote
0
answers
26
views
How to develop an anti-debug library which allow users to debug their own programs but not the library?
I'm going to publish a library which guarded by anti-debug ,(ptrace_trackme for Linux and isDebuggerPresent for windows).
The down side of this library is: users would be abled to debug their own ...
- 81
1
vote
0
answers
22
views
ZTE F670 V1.1.10P3T21 encrypted config.bin
I want to decrypt config.bin
For this I found in cspd
following code
undefined4 CspDBInitPdtInterface(undefined4 *param_1)
{
dbAddCfgItem(0xffff,0,"/userconfig/cfg/db_user_cfg.xml");
...
- 11
2
votes
0
answers
44
views
Booting a Linux kernel ARM64 boot executable Image
I am self learning reverse engineering and working on reversing a firmware image for an unknown ioT device that's running on Zephyr. I have the firmware image (.img file), which returns 'Linux kernel ...
- 21
3
votes
0
answers
36
views
Linux persistance between runs of program but not between reboots
I am working on reverse-engineering a linux program with a function that reads in configuration information from a file, and then passes this information to the program. However, after I fully exit ...
- 31
4
votes
0
answers
106
views
How to assemble back a disassembled Linux kernel?
I have a Linux kernel file and I need to tweak the contents of its corresponding initramfs. I did it in the past for standard distros where kernel and initramfs were separate. However, this specific ...
- 141
3
votes
0
answers
284
views
Problem getting root shell on Ezviz camera
I got a CS-C6N Ezviz camera. My friend gave it to me because he doesn't use it anymore. I was able to get rtsp stream from the camera (but laggy), and I also was able to connect to UART port on the ...
- 239
2
votes
0
answers
129
views
Cannot load libvulkan.so on Linux chroot running on Android while normal Android apps can load it
Environment
First I will give a quick summary of my environment
Device: Samsung Galaxy M20 (m20lte)
SoC: Exynos 7904 (with Mali-G71 GPU)
OS: Android 10 (Stock ROM with root using Magisk)
Kernel: 4.4....
- 239
5
votes
1
answer
98
views
Check if libc.so use tcache
I have ARM libc.so (GLIBC), How can I check if that libc.so used tcache, and what is the value of arena_max?
Can I check that information offline?
- 181
3
votes
0
answers
104
views
Setting a breakpoint on a shared library's decompiled exported function, and making Ghidra actually stop on that function when debugging a client code
I am very new to Ghidra, so please accept my apologies if my question sounds too simple. Despite the poor quality of the Internet in my country, I tried my best to find an answer online before asking ...
- 31
2
votes
1
answer
127
views
How to access files stored in mouse?
I own a Razer Mamba Elite mouse. After plugging it in to the usb port, an software installation window shows up. Basically it's the Razer software to manage device's options such as profiles, macros, ...
- 21
3
votes
0
answers
328
views
Steghide Linux Steganography how to get "Passphrase"
I am currently on Parrot Linux and have an image has a hidden steganographic inside.
I know I need to decode it with Steghide in the Parrot Terminal.
I also know that I will find out what the hidden ...
- 51
2
votes
1
answer
139
views
How can I verify section -> segment mapping for ELFs on linux?
I'm looking at at ELF on linux and I have readelf --segments ./myELF which shows:
Program Headers:
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align
PHDR ...
- 1,770
1
vote
1
answer
145
views
How do I install fail2ban to Zyxel nas326
So I just got Zyxel nas326 and I looked from internet how to protect nas from bruteforce attack and I found that fail2ban can protect my nas.
Then I found that I can't download any programs to nas326. ...
- 31
1
vote
0
answers
41
views
Where can I get source code for ASCII graph parser?
My plan is to see source code graph in vim of doxygen.
I almost use TUI on Linux.
So, Where can I get C, Python based source code for ASCII graph parser?
- 21
0
votes
1
answer
178
views
Output from gcc containing all included source code?
Right now, I'm using a combination of gcc -g and the objdump -S modes to generate assembly code with debug source code interleaved. However, I'm having trouble correlating some of the functions that ...
- 1,016
4
votes
1
answer
135
views
How to debug cfg80211.ko
I have an Linux embedded device that I want to debug the cfg80211.ko
I have full root SSH on that device.
How can I debug cfg80211.ko?
- 181
5
votes
0
answers
228
views
What utilities allow you to debug a process without pausing execution?
I was just reading this answer on StackOverflow, "How can you debug a process using gdb without pausing it?"
The Linux kernel provides some support for this via PTRACE_SEIZE, but gdb doesn'...
- 1,724
2
votes
2
answers
271
views
Examining memory without attaching to the process by using /proc/$PID/mem?
I have a gap in my understanding and tooling. Now I would prefer to use Radare2, but will consider any answer. Let's use this program as an example.
#include <stdio.h>
#include <unistd.h>
...
- 1,724
1
vote
1
answer
66
views
Patching a B(ranch) causes segfault in ARMv7 binary, while the same patch (with JMP) works on x64 binary
Any ideas why trying to patch a ARMv7 binary causes a segfault while basically the same patch on the Win64 version of the software works as expected?
Here is the Win64 version, that works
UPX0:...
- 11
2
votes
0
answers
152
views
What hints can x86 disassembly give as to GCC/G++ compiler version and options?
I've taken an interest to disassembling binaries and attempting to recreate 1:1 source code (logic) in C and C++ compiled with GCC. I say "logic" because this question does not pertain to ...
2
votes
1
answer
405
views
Load to Ida binary with all of SO
I have a Linux ARM binary with a lot of shared libraries.
Can I load all of them into one IDA instance so that I can easily navigate between functions? For example: functions that the binary calls and ...
- 181
0
votes
1
answer
280
views
Debugging Windows applications on Linux: Hardware watchpoints and backtracing in IDA not working and winedbg hardware watchpoints borderline unusable?
As in the title. Maybe someone has any experience with this. It's a significant impediment when trying to debug Windows applications on Linux. I find hardware watchpoints, in particular, to be ...
- 115
2
votes
0
answers
4k
views
Extracting ZTE F670L router's config.bin file
I want to enable telnet in my router (ZTE F670L V9.0.11P1N20D), So, I backup my router and i have a file config.bin, Size 23.5KB. I fired up kali and when i issue this command:
$ file config.bin
...
- 21
3
votes
1
answer
387
views
How to use linux .debug file with Ghidra
I have an ELF64 binary that comes with *.sym and .debug. From my understanding this is something akin to PDB. While IDA loads it automatically, it fails to process it. I was wondering if Ghidra will ...
- 43
1
vote
1
answer
173
views
Need help identifying this SoC
Does anybody know the manufacturer of this ARM CPU / SoC? I cannot find any information about it. I don't even know what the character in front of “Star” means.
“SAV500D” seems to be the model, the ...
- 25
1
vote
2
answers
639
views
Run a python in command (kali) with "run" on gdb-peda$
While debugging a program under gdb with gdb-peda installed, I need to pass args to the binary using output from something like python.
Why I am not getting AAAAA?
gdb-peda$ b doSomthing
gdb-peda$ run ...
- 21
1
vote
1
answer
1k
views
how to decrypt zte zxhn h108n V2.5.5_VDFT13 config.bin?
I need the root password from my router. I need to change my snr because my provider had lock it at a high value. I try to decrypt my config.bin file but no result. I try first with zte-config-utility
...
- 11
0
votes
0
answers
60
views
How to determine file system or open unknown .img file
I have a .img file which will not mount, open, extract or anything within Windows using either the tools built into Windows 10, WinRAR or 7-Zip, they all return errors.
I'm trying to look at data ...
- 11
1
vote
0
answers
28
views
Using rbreak without import functions
While debugging with GDB I want to break for each function and print the PC register.
rbreak .
define hook-stop
i r $PC
c
end
The problem is that is stop on functions that imported like printf ...
2
votes
0
answers
107
views
Edit Squashfs filesystem in flash memory
I have read Flash memory and analyze with binwalk and find out Squashfs that I can extract with dd and open with unsquashfs .
When I open this FS I want to add some file into this FS and edit some ...
1
vote
0
answers
85
views
How can I determine the bluetooth commands needed to communicate with my smart scale via bluetooth using my computer?
I have a Tanita-BC401 smart scale. This scale pairs with the "My Tanita" app via Bluetooth.
I have enabled the "Bluetooth HCI Snoop Log" developer option in my Android phone and ...
- 11
1
vote
1
answer
1k
views
How can I find out the size of heap allocations?
While I debug with GDB I see the address of a buffer that's located on the heap.
How can I know what is the size of this buffer? Or where (in the code) this buffer was originally allocated?
When I ...
2
votes
0
answers
390
views
Passing a String into a Function With GDB
So, I have a function with the prototype according to GDB:
{std::string (std::string)} 0x56027729e545
<function(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator&...
- 21
1
vote
0
answers
55
views
parallel NAND flash dumped with dd mtd0-12
Hi hope some one can help i have tried dumping nand on a system in u-boot with the dd command so i have mtd0-12 but have now messed up bootloader now i have non booting device/brick. i have tried jtag ...
- 11
0
votes
1
answer
813
views
Running ELF file built for ARM arhitecture
My goal is to run and debug ELF file (c444) which is compiled for the ARM architecture. I have some experience with x32 and x64 Intel architectures. However, I down know how to proceed with ARM-based ...
- 1
1
vote
0
answers
100
views
Launching Linux kernel on UART serial interface, but can't login because key-mappings change randomly
I am trying to root an old Linux device I have, it uses the CFE bootloader by Broadcom. I know the username and the password, but something really strange happens when I try to login.
I get a prompt ...
- 263
1
vote
1
answer
47
views
How to capture control flow pins on emulated serial port?
I am reverse engineering how a CPS software package communicates to a radio device. I have the basics down, and want to trick the software into thinking COM1 is the radio, when in reality I want to ...
- 271
1
vote
0
answers
67
views
Handle Ioctl call while running with qemu
I am using qemu to emulate a binary like this
qemu -strace XXXXX .
I saw that the first 2 system calls of this process were TCGETS to stdin and stdout. From man pages
Get and set terminal attributes
...
- 21
1
vote
0
answers
217
views
Why IDA debugger keep receiving SIGTRAP or SIGSEGV after set a break-point and then deactivated that break-point
Here's the problem:
I set a breakpoint in IDA debugger
the program stop at the breakpoint
deactivated the breakpoint
IDA keep receiving SIGTRAP or SIGSEGV
( program stop at breakpoint as expected ) :...
- 131
2
votes
0
answers
590
views
Repacking vmlinux into zImage/bzimage
While RE an embedded device I ran into a problem - I need to patch a check in the kernel which has no sources available. Unpacking the kernel and binary-patching went smoothly. However I cannot get ...
- 163
0
votes
1
answer
370
views
How to get the input necessary to get to the end
In short, I have a code that gets an input via stdin. Once it has the input string in memory, it verifies its integrity by calling a function for every condition, and exiting the program if those ...
1
vote
1
answer
118
views
Create Fake Entry in sysfs
I'm targeting a program that tries to open a file in /sys that doesn't exist. Is there a way to create that file so the program continues? (Normally you can't create flies in sysfs.)
- 131
0
votes
0
answers
831
views
unix executable Error: Reading 0x1b50 bytes extends past end of file for string table
info on the file it is called ld it is a command for linking elfs called link editor. Does Error: Reading 0x1b50 bytes extends past end of file for string table mean I am missing some kind of offset? ...
1
vote
1
answer
65
views
Replacing firmware, Longshine Shinebook
Am wondering how to replace the firmware on a Longshine Shinebook (manual, firmware, more stuff).
Assuming I modify the firmware files, how do I put the new version on the device? I'm guessing there ...
- 133
2
votes
0
answers
202
views
Why PTRACE_POKEDATA returns I/O error?
I learning usage of ptrace.
I tried following simple example but raises a I/O Error.
I would like to overwrite "Hello, world" (printing string) from other process.
A target program prints &...
- 141
1
vote
1
answer
113
views
What could a firmware image be, if not embedded linux?
I decided to play around with an old baby monitor, purely to learn something about how such things (I.E. embedded devices) work. I successfully extracted the flash memory, and I was expecting this to ...
- 113
2
votes
1
answer
184
views
Comparing the static address of the vtable of a class, to the pointer to it held by the object
I know this is compiler/ABI dependent, not necessarily standardized, etc. I've always assumed, from what I've read in several places (e.g. an answer here or the example in wikipedia), that a typical ...
0
votes
1
answer
68
views
Program goes to suspend when buffer overflow occurs
Full disclosure: I am seeking help to complete a college assignment. I am seeking help on steps where I am stuck and unable to move forward, not a ready made answer.
I need to exploit it to get a ...
1
vote
1
answer
135
views
Identify strings shared between multiple files from the Linux command line
Given a set of arbitrary files, what's the best way to identify the text strings shared between them (either in all files or a subset of them) from the Linux command line?
This would be useful for ...
- 195
0
votes
1
answer
403
views
Is it possible to intercept syscalls with a custom code from inside the program?
I have a binary calling syscall with a code not present on the Linux kernel.
Is it possible that the binary catches the syscall by itself and handles it on-the-fly?
Furthermore, what happens if I call ...
- 3