Questions tagged [linux]
A free and open source POSIX compatible operating system with a monolithic kernel and a kernel module system. Originally created by Linus Torvalds.
32
questions
11
votes
3
answers
22k
views
ZTE encrypted backup config file
I was poking around in ZTE Speedport Entry 2i (CPE used mostly in Germany, Slovakia etc, probably custom made for Deutsche Telekom). It's possible to download backup of config from UI.
I found out ...
- 271
8
votes
1
answer
874
views
Why are values passed through useless copies?
So, say that I have the following code, which gives three examples of what I believe to be unnecessary copies of values.
mov QWORD PTR [rbp-0x18],rdi
mov rdx,QWORD PTR [rbp-0x18]
lea rax,[...
- 285
85
votes
3
answers
128k
views
How are the segment registers (fs, gs, cs, ss, ds, es) used in Linux?
I try to understand the process of memory segmentation for the i386 and amd64 architectures on Linux. It seems that this is heavily related to the segment registers %fs, %gs, %cs, %ss, %ds, %es.
Can ...
- 18.7k
47
votes
8
answers
33k
views
How do I add functionality to an existing binary executable?
I want to add some functionality to an existing binary file. The binary file was created using gcc.
Do I need to decompile the binary first, even though I sufficiently understand the functioning of ...
- 2,435
19
votes
2
answers
34k
views
Managing inputs for payload injection?
I am looking for a complete list of the ways to inject a payload in a vulnerable program in a Unix (Linux) context depending on the inputs opened by the program.
I know that there are several tricks ...
- 18.7k
21
votes
3
answers
18k
views
Detecting tracing in Linux
Under Linux it's possible to trace exactly the kernel system calls with strace.
ltrace can be used also to trace library calls.
I wonder if it's possible to detect if my executable is running under ...
- 4,755
4
votes
1
answer
2k
views
/proc/self/maps equivalent on windows
I see that inspecting /proc/self/maps on Linux machines lets me see the pages that have been mapped in. As a result I can write a program to read and parse the pages it has mapped in.
How could one ...
user1743
123
votes
2
answers
94k
views
How to handle stripped binaries with GDB? No source, no symbols and GDB only shows addresses?
I have GDB but the binary I want to reverse engineer dynamically has no symbols. That is, when I run the file utility it shows me stripped:
ELF 64-bit LSB executable, x86-64, version 1 (SYSV), ...
- 10.8k
18
votes
1
answer
4k
views
Debugging with radare2 using two terminals
I have been trying to figure this out for quite some time now, and would really need some help. Firstly, some intro:
I am running the newest version of radare2 from Github on a 64bit Ubuntu 16.04 and ...
- 1,053
2
votes
3
answers
7k
views
Where can I get Linux malware samples?
There have been numerous sites stated in this wonderful post that one could retrieve malware samples. However, I am having a difficult time (sorry D:) locating Linux-specific malware from those sites ...
- 117
23
votes
2
answers
14k
views
How to reverse engineer simple usb device [windows -> linux]
I'd like to reverse engineer my usb beer-can refrigurator, which does connect via USB on windows and via simple GUI tray-tool can set/query temperature.
I was thinking about running virtualboxed ...
- 231
6
votes
3
answers
6k
views
RE Compressed backup file,router linux based so is it compresed with zlib?
so I have backup from my router its zte zxv10h201l and its linux based but I can not identify type of compression of this file.
Here is couple of first "lines" of it
00000000 99 99 99 99 ...
- 505
5
votes
4
answers
6k
views
Identify compression of this ZTE ZXV10 H201L V2 backup config file
This config.bin file is from a ZTE router. I would like to decompress it but I did not identify the compression used in the file. Maybe someone can.
00000000 99 99 99 99 44 44 44 44 55 55 55 55 aa ...
- 505
2
votes
2
answers
681
views
Putting an application in between client and server
I'm attempting to reverse engineer (without dissecting the source code, as my understanding is that reverse engineering by analyzing input and output and building something from scratch that fits is ...
- 123
2
votes
1
answer
4k
views
IDA Pro debugging: follow child process
I'm reverse engineering a malware that creates a number of child processes and I'm trying to do dynamic analysis of the ELF binary with IDA Pro and IDA's Local Linux Debugger, but I can't get IDA to ...
- 21
9
votes
2
answers
25k
views
How to reverse engineer a Linux executable to find the parameters? [closed]
So I am on a Linux box with an executable.Vague - I know. This is what happens when I try and run it with an argument/parameter:
me@there:~$ ./theFile theOption -a
./theFile : option requires an ...
- 221
8
votes
4
answers
14k
views
How to check if an ELF file is UPX packed?
I have an ELF file and want to know if it is UPX packed. How can I detect UPX compression in GNU/Linux?
- 527
7
votes
1
answer
1k
views
How does API call work on Android (NDK)?
In windows platform, an application usually references its IAT(Import Access Table) to get the address of the APIs it wants, then call it. Then some mechanisms are done as demonstrated here nicely.
...
- 331
6
votes
3
answers
11k
views
Packers/Protectors for Linux
I was wondering if anyone had come across a packer/protector which could be used for ELF binaries. There seem to be quite a few articles on writing packers and protectors for the PE format -- however, ...
user1743
6
votes
3
answers
2k
views
Reversing self-modifying code
I am learning reversing an I am studying a code, which modifies itself (actually it is a crackme).
It contains statements like: movw $0xc031, 0x(%edx), where edx contains the address of a statement. ...
- 867
5
votes
1
answer
5k
views
Why are symbols with local binding present in the symbol table of my ELF files?
I found out that there are symbols with binding=LOCAL and visibility=HIDDEN in the symbol table (.symtab) of ELF executables/libraries. What are they needed for? They are not involved in the ...
- 51
5
votes
1
answer
978
views
Need help with a USB gaming mouse
I have a Chinese USB gaming mouse (04d9:a070) which has 4 color modes and 4 light levels. I know for a fact that this mouse is capable for showing at least 5 different color so it must be an RGB led (...
- 53
3
votes
1
answer
1k
views
ELF binary injection
I am currently working on an ELF-injector and my approach is standard: find code cave (long enough sequence of 0's), rewrite it with the instructions I want to execute and then jump back to the start ...
3
votes
1
answer
6k
views
What does fs and gs registers provide in Linux?
In a 64 bit ELF binary I found it mainly uses fs register to get some values. How can I know which value it wants to access? I'm familiar with that NT kernel uses fs and gs register for TEB structure ...
- 1,549
3
votes
2
answers
551
views
How to find location of environment variables in 64 bit binaries at runtime?
In the main function, program authors can choose to receive the char * array as a parameter to main that points to the environment variables
int main(int argc, char **argv, char **envp) {
...
}
The ...
- 163
2
votes
0
answers
1k
views
Passing input to program in Remote Debugging with IDA Pro
I am writing an exploit for a binary on Linux using IDA Pro. This binary, first accepts an input using getchar() and after few more code sections, it accepts a buffer as an input through stdin and it ...
- 765
2
votes
1
answer
3k
views
Disassemblers resolving (ELF) section names
I'm working with linux executables and was just wondering how it is that section names are resolved to addresses upon disassembly of an ELF.
For example take some random disassembly output from ...
2
votes
0
answers
1k
views
open a non-standard compression .tar.lzma file extracted from firmware download
We are trying to examine a firmware download for a product we have running on our local network. Using the command
binwalk -Me filename
we generated a folder that contains the following content:
...
1
vote
1
answer
687
views
Find code executed on button press in Qt5 Linux application
I have an executable of a (rather simple) GUI application on Linux, built in Qt5. I am able to run it, and want to find out what happens internally when I press one of the buttons.
I suspect that the ...
- 11
1
vote
1
answer
162
views
3 questions on Assembly - meaning of code, Decompilation in Linux, Higher level perspective,
Following the question here (3 questions on assembly - syntax, meaning, and equivalent in high level code (eg C++)), I would like to know for the same x86 code in AT&T syntax:
xor $0x20, (%eax)
...
- 365
1
vote
1
answer
5k
views
Unable to view stack and memory addresses in IDA Pro [duplicate]
I am debugging a 32-bit ELF executable using remote GDB debugging option of IDA Pro. However, I am unable to view the contents of stack in the stack view. Also, the stack pointer value is: 0xFFFFD328
...
- 765
0
votes
3
answers
8k
views
Limited BusyBox shell
I'm testing some embedded device, and there is lack of documentation. When I telnet to device, I get only limited shell.
BusyBox v1.19.2 (built-in shell (ash)
Enter 'help' for a list of built-in ...
- 113