Questions tagged [linux]

A free and open source POSIX compatible operating system with a monolithic kernel and a kernel module system. Originally created by Linus Torvalds.

Filter by
Sorted by
Tagged with
4
votes
3answers
4k views

RE Compressed backup file,router linux based so is it compresed with zlib?

so I have backup from my router its zte zxv10h201l and its linux based but I can not identify type of compression of this file. Here is couple of first "lines" of it 00000000 99 99 99 99 44 44 44 ...
2
votes
0answers
20 views

What is actually loaded here and different hexdump outputs on util-linux hexdump and on cutter and ghidra's hexdump

I was trying to understand what segment of file gets loaded by fourth LOAD header on phdr array. First 6 headers are shown below from readelf Program Headers: Type Offset ...
1
vote
1answer
51 views

Why have two symbols tables?

Why have two symbol tables if .symtab already contains everything that's in .dynsym ?
5
votes
3answers
867 views

Linux protectors: any good one out there?

I know no one that works as of today (i.e., kernels not way too old) and I wonder if anybody found or knows any protector for Linux either commercial, open source, used in malware, etc...
4
votes
2answers
91 views

Can i trap SIGSEGV (on a linux) and what are are the conditions to make it works ? (for a crackme)

Friendly greetings ! I'm writing some crackmes.one challenge and i want to write a challenge where the solution appears on a segmentation fault. (And you have to disassemble the code to find a way ...
5
votes
3answers
5k views

Packers/Protectors for Linux

I was wondering if anyone had come across a packer/protector which could be used for ELF binaries. There seem to be quite a few articles on writing packers and protectors for the PE format -- however, ...
2
votes
2answers
72 views

How can I pass input to my program while debugging it with IDA

I have a program that waits for the user to enter a string input, how can I enter that string input while debugging my program with IDA?
1
vote
1answer
50 views

Unexpected SEGFAULT when there's apparently nothing that would cause it

This is a from a CTF problem I'm working on. Hopefully it's appropriate to ask this question here. Above is the GDB output when the segfault goes off. movaps is the offending instruction, meaning ...
0
votes
1answer
61 views

Understand what Ioctl do

I looking in ida on arm linux binary . I can see there that there is ioctl call ioctl(fd,req,num). fd is fd to /dev/module. ,req is some 4bytes and num is some number. How can I understand what ...
1
vote
1answer
125 views

Changing entry-point of and ELF file

I'm trying to conduct a little experiment which basically consists of changing the EP of an ELF file and executing an exit(9) syscall, without returning to the OEP. As shown in the image everything ...
0
votes
2answers
1k views

Adding additional language to Linux based Firmware of Volkswagen Car Radio

I'm owning a CarPlay head unit from Volkswagen called RCD330 plus. It is possible to upgrade/downgrade to any available firmwares. For example here are two firmware versions: http://rcd330plus.com/rcd/...
0
votes
1answer
111 views

Changing local variable in caller from callee in C?

I'm implementing a function which is going to perform some time-consuming task, and I'd like to hack the benchmarking part a bit by changing the variable indicating the CPU time my function has ...
21
votes
5answers
31k views

What is the linux equivalent to OllyDbg and Ida Pro?

What is the Linux equivalent to OllyDbg and IDA Pro ? Or if there are multiple tools that do the various functions that OllyDbg and IDA Pro do, where can I find these tools? I'd like to start ...
1
vote
1answer
38 views

Find out if address store in heap or stack

While dynamic debugging with ida and gdb-server on binary file running on linux , I saw address that store some value. How can I know if this address allocated in stack or in heap?
1
vote
0answers
64 views

Sniffing TCP packets using Wireshark

I am trying to reverse engineer a decoder. The decoder contains a web server that makes sending/receiving information through the Internet possible. To do so I need to sniff the packets that the ...
8
votes
1answer
3k views

Reverse Engineering ZyXel C1100Z modem firmware

first time post so please bear with me. For days I have been trying to bypass a password my ISP has added to their remote CLI with no luck. I have a Zyxel C1100Z DSL modem that I've purchased from ...
8
votes
2answers
8k views

ZTE encrypted backup config file

I was poking around in ZTE Speedport Entry 2i (CPE used mostly in Germany, Slovakia etc, probably custom made for Deutsche Telekom). It's possible to download backup of config from UI. I found out ...
0
votes
1answer
150 views

mprotect syscall not working

I want to modify the protection of the .text segment to RWX using a shellcode. In the shellcode, I can issue the syscall for mprotect however it's not working. Per the sys_mprotect definition, it ...
4
votes
2answers
247 views

Extracted router file execution

I am trying to run an executable file that I dug out from an extracted file system of a DSL modem router. So first of all I needed to either have a MIPS Linux box or take the emulation path. After ...
0
votes
0answers
31 views

IDA remote debugging - non printable characters in parameters

I am trying to remote debug a certain binary which gets user-specified command line arguments, which can be non-printable of course. My goal is the ability to debug with IDA the process with the ...
2
votes
1answer
144 views

Help needed to extract u-boot kernel & rootfs - nxp lpc 3143 processor

I have a board where in principle aim at emulating a DVD-ROM loading iso file from a drive. This board is running a ARM CPU with 32MB of ram and has no vga output. The firmware update comes with 2 ...
2
votes
0answers
1k views

How to set-up GDB debugging in IDA Pro on Linux via Wine?

I tried running on linux via root terminal: gdbserver --multi localhost:23947 And then at IDA Pro at Wine I use Remote GDB debugger with my local ip and port: However when I start debugging I think ...
1
vote
1answer
235 views

Mechanisms to stop serial console accepting input on a Linux system?

I am working on a simple embedded system based around an Olinuxino board. This has a serial console header onboard. TX and RX are both connected to the respective pins on the microcontroller (i.e. ...
7
votes
2answers
3k views

ARM64 syscalls table

I wonder if there some syscall table for Linux ARM64 architecture? I found syscall table for Linux ARM32 and many other architectures, but the problem still exists. Does anyone know where can I find ...
0
votes
0answers
18 views

Stack trace with GdbServer

When I debug binary file on linux with gdbServer with Ida ,I don't see stack trace. Why? How can I fix it to see stack trace??
2
votes
1answer
171 views

Cannot open '/proc/…/maps': No such file or directory in radare2 debug mode

When I try to load a program to radare2 debug mode, most of the time I get the following error: $sudo r2 -d a.out Hello world!= attach 2851 2851 Cannot open '/proc/2851/maps': No such file or ...
1
vote
1answer
119 views

Lipo alternate for linux

Currently, I'm using lipo tool to extract the arch type from a fat iOS binary on a Mac OS. Now, I want to do the same on the linux platform for the iOS binaries, i.e. extract a given arch type from a ...
1
vote
0answers
65 views

Decrypt ibt.sfi linux firmware(Intel Wireless 8265 Linux Bluetooth)

Why I want to decrypt: Intel 8265 Bluetooth is likely a RAMUSB device, which needs system to update firmware. I try to transplant this linux firmware to macOS. Problems I met: The macOS BT firmware ...
0
votes
1answer
32 views

What is causing \r\n in libnotify? [closed]

I am trying to look under the hood of libnotify, and ran strace notify-send 'hello' and one of the system calls is: sendto(5, "AUTH\r\n", 6, MSG_NOSIGNAL, NULL, 0) = 6 Surrounded by a: sendmsg(5, {...
1
vote
1answer
99 views

Fork and Waitpid calls in a CTF linux binary

I'm doing one of my first linux crackmes. In the first blocks of code, it goes inside some anti-debug routine and inside one of those it forks and after it calls a waitpid routine. I can verify it ...
5
votes
1answer
7k views

Managing inputs for payload injection?

I am looking for a complete list of the ways to inject a payload in a vulnerable program in a Unix (Linux) context depending on the inputs opened by the program. I know that there are several tricks ...
1
vote
1answer
1k views

How does this version of `rm -rf /` work?

On this website, I found the following code: char esp[] __attribute__ ((section(”.text”))) /* e.s.p release */ = “\xeb\x3e\x5b\x31\xc0\x50\x54\x5a\x83\xec\x64\x68\" “\xff\xff\xff\xff\x68\xdf\xd0\xdf\...
1
vote
1answer
107 views

why saved rip changed by push?

I am doing a reverse homework. see the following pictures: as can be seen from this picture, before call push touch3, "saved rip" is at 0x5561dca8, which is equal to the current rsp(0x5561dca8). ...
1
vote
0answers
573 views

OTOOL alternative for linux

I have a reverse engineering set up on a Mac machine. This set up does some reverse engineering on iOS applications(.ipa files). I'm migrating the setup from Mac to a linux machine. Currently on Mac, ...
0
votes
1answer
56 views

Significance of link address 2000 8000 7C00;

Can you explain to me the significance of link address 2000 8000 7C00? It's in a MACRO from the GRUB configure script, which checks whether OBJCOPY works for absolute addresses. Here's the snippet ...
2
votes
1answer
71 views

Process Immediately Killed

I'm trying to reverse an ARM executable. It's for an embedded system, but I don't have any details about the normally targeted environment. Here's what file shows: ELF 32-bit LSB executable, ARM, ...
0
votes
1answer
1k views

Unpacking firmware

I have a ROM dump firmware which must be reversed (as a task). Binwalk output: DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------------------------------------...
0
votes
1answer
56 views

Remote debugger for Linux from one VM (IDA) to another (running the debuggee)

I want to debug a Linux program (ELF), but my IDA Pro is on a Windows 10 VM and I want to use remote debugging to debug the program on Ubuntu (also in a VM). So, is it possible to debug if both ...
1
vote
1answer
54 views

Unknown parameters in custom signal handler on Linux

0x0000000008001946: mov 0xa8(%rdx),%rax 0x000000000800194d: lea 0x28(%rdx),%rsi 0x0000000008001951: lea 0x2(%rax),%rdi 0x0000000008001955: add $0xe,%rax 0x0000000008001959: ...
0
votes
1answer
97 views

How do I go about overriding a function internally defined in a binary on Linux?

To be specific, I cannot recompile this binary, nor do I have access to the sourcecode. The functions are not defined within a shared library. So, how can I go about changing a function, or ...
3
votes
2answers
154 views

Remote Debugging Linux Binaries - Stack Address Changes?

Do stack addresses change every time we remotely debug a Linux binary using linux_server and IDA Pro? I am using IDA Pro and remote debug a linux binary which is running on a Linux machine and I am ...
2
votes
0answers
1k views

Knockoff CGA/EGA to vga firmware update [closed]

The problem with this, as I know from experience in dealing with this exact same issue is the firmware in the CGA/EGA/VGA converter board. There is an update that needs to be written to the converter ...
3
votes
3answers
4k views

Use Android Shared library (.so) files in Linux

I decompiled an APK file,and that program have native codes in a .so file. I want to use that .so file in Linux in order to use inline functions. These codes have functions to connect to a server and ...
5
votes
1answer
306 views

How does API call work on Android (NDK)?

In windows platform, an application usually references its IAT(Import Access Table) to get the address of the APIs it wants, then call it. Then some mechanisms are done as demonstrated here nicely. ...
2
votes
2answers
140 views

Step Over not working in GDB

In the function below, let's say EIP is 0x400688. Now, I want to step over the call instead of stepping inside the subroutine. 0x40067a <main+4> sub $0x20,%rsp ...
1
vote
2answers
3k views

How can I change the value of a variable while debugging?

I know that I can output the value of a variable using (gdb) p var_name $1 = "varvalue" Is there a way to set the value of a variable while debugging with gdb? The document that I'm using doesn't ...
1
vote
1answer
124 views

Question regarding ASLR

If I have a binary file which does not have ASLR enabled. However, the libc file it uses has ASLR enabled, then will the address of system() in libc file be randomized every time? Or the address will ...
0
votes
1answer
73 views

Linux Assembly Syscall

I'm learning how to write shellcode by using Linux system call "execve" to spawn a shell with root access privilege. Here i found a shellcode online: http://shell-storm.org/shellcode/files/shellcode-...
0
votes
0answers
283 views

Executing MIPS binaries on Ubuntu Linux

I have a 32-bit MIPS binary and I'm trying to execute it on Ubuntu 64-bit. file command for the binary shows: bin: ELF 32-bit MSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), dynamically linked (...
1
vote
1answer
851 views

What does fs and gs registers provide in Linux?

In a 64 bit ELF binary I found it mainly uses fs register to get some values. How can I know which value it wants to access? I'm familiar with that NT kernel uses fs and gs register for TEB structure ...