Questions tagged [linux]

A free and open source POSIX compatible operating system with a monolithic kernel and a kernel module system. Originally created by Linus Torvalds.

Filter by
Sorted by
Tagged with
-1
votes
0answers
27 views

extract firmware from .p7b file

how to extract LZMA compressed F/W image from .p7b file? binwalk output: DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------------------------------------- 0 ...
1
vote
0answers
20 views

parallel NAND flash dumped with dd mtd0-12

Hi hope some one can help i have tried dumping nand on a system in u-boot with the dd command so i have mtd0-12 but have now messed up bootloader now i have non booting device/brick. i have tried jtag ...
0
votes
1answer
87 views

Running ELF file built for ARM arhitecture

My goal is to run and debug ELF file (c444) which is compiled for the ARM architecture. I have some experience with x32 and x64 Intel architectures. However, I down know how to proceed with ARM-based ...
1
vote
0answers
30 views

Launching Linux kernel on UART serial interface, but can't login because key-mappings change randomly

I am trying to root an old Linux device I have, it uses the CFE bootloader by Broadcom. I know the username and the password, but something really strange happens when I try to login. I get a prompt ...
1
vote
1answer
25 views

How to capture control flow pins on emulated serial port?

I am reverse engineering how a CPS software package communicates to a radio device. I have the basics down, and want to trick the software into thinking COM1 is the radio, when in reality I want to ...
1
vote
0answers
33 views

Handle Ioctl call while running with qemu

I am using qemu to emulate a binary like this qemu -strace XXXXX . I saw that the first 2 system calls of this process were TCGETS to stdin and stdout. From man pages Get and set terminal attributes ...
1
vote
0answers
32 views

Why IDA debugger keep receiving SIGTRAP or SIGSEGV after set a break-point and then deactivated that break-point

Here's the problem: I set a breakpoint in IDA debugger the program stop at the breakpoint deactivated the breakpoint IDA keep receiving SIGTRAP or SIGSEGV ( program stop at breakpoint as expected ) :...
0
votes
0answers
43 views

Linux allocator and heap exploitation

I have some internal questions regarding linux allocator and heap exploitation: Is there a technique/techniques to discover the type of the memory allocator in linux(for example: dlmalloc/ptmalloc/...
1
vote
0answers
167 views

Repacking vmlinux into zImage/bzimage

While RE an embedded device I ran into a problem - I need to patch a check in the kernel which has no sources available. Unpacking the kernel and binary-patching went smoothly. However I cannot get ...
0
votes
1answer
91 views

How to get the input necessary to get to the end

In short, I have a code that gets an input via stdin. Once it has the input string in memory, it verifies its integrity by calling a function for every condition, and exiting the program if those ...
1
vote
1answer
35 views

Create Fake Entry in sysfs

I'm targeting a program that tries to open a file in /sys that doesn't exist. Is there a way to create that file so the program continues? (Normally you can't create flies in sysfs.)
0
votes
0answers
104 views

unix executable Error: Reading 0x1b50 bytes extends past end of file for string table

info on the file it is called ld it is a command for linking elfs called link editor. Does Error: Reading 0x1b50 bytes extends past end of file for string table mean I am missing some kind of offset? ...
1
vote
1answer
46 views

Replacing firmware, Longshine Shinebook

Am wondering how to replace the firmware on a Longshine Shinebook (manual, firmware, more stuff). Assuming I modify the firmware files, how do I put the new version on the device? I'm guessing there ...
2
votes
0answers
42 views

Why PTRACE_POKEDATA returns I/O error?

I learning usage of ptrace. I tried following simple example but raises a I/O Error. I would like to overwrite "Hello, world" (printing string) from other process. A target program prints &...
1
vote
1answer
53 views

What could a firmware image be, if not embedded linux?

I decided to play around with an old baby monitor, purely to learn something about how such things (I.E. embedded devices) work. I successfully extracted the flash memory, and I was expecting this to ...
2
votes
1answer
46 views

Comparing the static address of the vtable of a class, to the pointer to it held by the object

I know this is compiler/ABI dependent, not necessarily standardized, etc. I've always assumed, from what I've read in several places (e.g. an answer here or the example in wikipedia), that a typical ...
0
votes
1answer
53 views

Program goes to suspend when buffer overflow occurs

Full disclosure: I am seeking help to complete a college assignment. I am seeking help on steps where I am stuck and unable to move forward, not a ready made answer. I need to exploit it to get a ...
0
votes
0answers
39 views

Configure Strace do not parse ioctl command

When I run strace strace -fp 123 -o log -e trace="ioctl" I saw ioctl that strace parse the ioctl command , How can I see the number of ioctl command without parsing?
0
votes
0answers
254 views

x64dbg for linux executables?

Is there a x64dbg for Linux executables? I really love x64dbg, but in a lot of CTF challenges there are Linux executables and not .exe files or .dll files.
1
vote
1answer
72 views

Identify strings shared between multiple files from the Linux command line

Given a set of arbitrary files, what's the best way to identify the text strings shared between them (either in all files or a subset of them) from the Linux command line? This would be useful for ...
0
votes
0answers
98 views

How do I debug Linux kernel modules with IDA?

I'm trying to figure out a workflow for analyzing Linux kernel modules. I want to debug the modules and not just view the disassembly, so I came upon this guide for IDA pro: https://www.hex-rays.com/...
0
votes
1answer
104 views

Is it possible to intercept syscalls with a custom code from inside the program?

I have a binary calling syscall with a code not present on the Linux kernel. Is it possible that the binary catches the syscall by itself and handles it on-the-fly? Furthermore, what happens if I call ...
3
votes
2answers
700 views

Huawei HG8245H, can't read some system files

I have modem Echolife HG8245H (V3R016C10S150). I'm using telnet to connect it. I need to read some files from this modem. There's a shell mode I can enter, but it is nerfed badly: SU_WAP>shell ...
1
vote
1answer
54 views

How to split bytes into instructions in binary ELF file for x86

I'm working on a static code injector for ELF files. I need to "steal" some bytes in order to write jump to my code on their place and then execute stolen instructions somewhere in the ...
0
votes
1answer
51 views

Call libc functions from the payload statically injected into ELF binary

I am working on ELF-injector, which given some payload (currently it's an assembly file with .text section only) will inject it into ELF binary. I had related post here. Now I would like to make it ...
0
votes
1answer
36 views

Why would just two bits of the SP be used here?

This is the section of disassembled code in question. It’s from a Linux kernel module compiled for 4.4.16 on ARMv7. ; Registers used: ; - r3 : unsigned long argp 0000005c mov r1, ...
0
votes
0answers
28 views

Ollydbg skippingover breakpoint

I am new to the ollydbg world- I am in the middle of injecting shellcode (created with msfvenom...) into a small PE, and during debugging, I can't get it to halt at the breakpoints I set. If I run the ...
2
votes
2answers
323 views

Where to get started with reverse engineering a usb video device on Windows?

I have a piece of proprietary hardware that I'm trying to reverse engineer and write a cross-platform open-source driver for. This device has an IR camera on it, and it seems to be using the UVC ...
-1
votes
1answer
26 views

can a stdout captured at a parameter to python script

I'm working on a CTF challenge that is find a secret password.This secret password base on the username and password that i input and the hash value had print out after hash calculation and i want to ...
4
votes
1answer
373 views

ELF binary injection

I am currently working on an ELF-injector and my approach is standard: find code cave (long enough sequence of 0's), rewrite it with the instructions I want to execute and then jump back to the start ...
1
vote
1answer
133 views

Does the operating system you use matter?

people recommend windows for reverse engineering, I don't want to install windows as a virtual machine because they are laggy and I already have windows 10 as host, is it possible to use linux vm that ...
1
vote
1answer
110 views

Edit IDA signal handler

In Ida Pro while debugging linux process with gdbserver I got window that show than SIGTRAP has been arrived, I choose to pass it to application. How can I edit that choose now? I want to ignore this ...
0
votes
1answer
255 views

Need help opening a .img file from a camera firmware (trying to get out of the Meari/Zumimall/PPstrong cloud!)

I've got a cloud-based battery powered camera which I'm really hoping to get out of the cloud with, in order to enable RTSP or ONVIF (or something local!). I've managed to get a .bin file. Binwalk ...
2
votes
2answers
177 views

ASLR in Linux Vs Windows

I am quite new in binary exploitation. I am doing a lot of beginners exercise here. I am confused about ASLR. I tried some binary exploitation thing in Linux. It was recommended that I should stop ...
2
votes
1answer
353 views

hooking libhoudini on x86 emulator

I'm trying to hook libhoudini to debug an application instruction by instruction using frida but frida not supports it i need a example on how can this be achieved! I'm using a x86 emulator to run arm ...
1
vote
0answers
75 views

Replacing bytes from start of every function with IDA Pro

I want to fix a .plt segment in IDA Pro by replacing 12 bytes from start of every function in the .plt segment with the ones I specify. I want to just make each function return so I'm replacing ...
2
votes
1answer
165 views

Linux keyboard driver windows reverse engineering

I have toshiba portege x30-f laptop with Fn keys not working under linux. I've read some articles about usb drivers reverse engineering, but the keyboard connected not via usb. As I can understand it ...
1
vote
0answers
55 views

Same USB packet (Python/user vs C/kernel) but different result

I'm making a Linux module (my first one) for a closed-source, enclosed (no hardware access) device. Using Wireshark I found what to send and where, so I tried the following command in user space ...
2
votes
2answers
112 views

Newbie problems exploiting a format string vulnerability

I encountered a print format vulnerability challenge in a CTF. I don't know anything about these vulnerabilities, so I'm working my way through Saif El-Sherei's format string exploitation tutorial ...
1
vote
1answer
90 views

I need help reverse engineering my ereader (trying to get into the shell)

I'm trying to reverse engineer my E-Reader. It's a Denver EBO-620. I want to change the off screen image and add my own fonts. With help of Reddit I've managed to log the startup sequence (shown down ...
1
vote
1answer
171 views

Linux Embedded board - Kernel Panic problems

I need to duplicate an old embedded board based on a Yocto-based Linux. I have bought a new board with the same part number and now I need to put the old software in the new board (the new board has ...
0
votes
1answer
71 views

Debug process that use /dev/watchdog

I want to debug a process with gdb into Linux system, but the problem is that process pings /dev/watchdog so when I tried to debug it, it stop the process for longer than the watchdog interval so the ...
-1
votes
2answers
76 views

Is address in program can change

I talking about linux arch. When I open program in Ida (statically ) I can see all instructions address like 0x20da mov r8 r2 When I want use that address to breakpoint (for example with ptrace or ...
1
vote
1answer
483 views

Unpacking, modifying, repacking and flashing a firmware

I've been trying to figure out how to modify the firmware on a DVR I bought for cheap recently. The built in software isn't great and doesn't offer any option for exporting video other than plugging a ...
0
votes
1answer
245 views

Find code executed on button press in Qt5 Linux application

I have an executable of a (rather simple) GUI application on Linux, built in Qt5. I am able to run it, and want to find out what happens internally when I press one of the buttons. I suspect that the ...
0
votes
0answers
183 views

Shellcode execution segfault

I have been trying to exploit simple buffer overflow caused by scanf. I'm working on x86 Linux. The point is to spawn a shell. I sucesfully overwritten return address and jumped into my shellcode. But ...
0
votes
1answer
106 views

How can I debug open source C code for Linux?

I want to debug & reverse engineer open source code such as this project. I usually use CLion to write and debug C code on Linux. I've also used GDB. What steps do I need to take to download a ...
2
votes
4answers
1k views

Endoscope Camera YPC99 - how to stream on linux

I'm trying to stream video from endoscope camera YPC99 on linux PC using the WiFi connection. From what I have found so far the camera is using IP 192.168.1.1. It supports RTSP protocol on port 7070 (...
2
votes
2answers
699 views

Repacking an embedded initramfs

I'd like to modify some of the init scripts in an initramfs that is embedded in a kernel bzImage. I know I can modify them by not changing the size of any files (e.g. by commenting out lines, and ...
1
vote
1answer
312 views

Find all syscall in statically Arm Binary

What is the easy and fast way to find all syscall in statically Arm binary ? Is there any Ida plugin that do that?

1
2 3 4 5
7