Questions tagged [linux]
A free and open source POSIX compatible operating system with a monolithic kernel and a kernel module system. Originally created by Linus Torvalds.
66
questions with no upvoted or accepted answers
9
votes
1
answer
6k
views
How to unpack manually an upx packed elf file
I am trying to learn to manually unpack an upx packed elf file. The examples I have found are for Windows, mostly with Ollydbg, and as I see the first step is to look for pushad and popad instructions....
- 867
5
votes
0
answers
228
views
What utilities allow you to debug a process without pausing execution?
I was just reading this answer on StackOverflow, "How can you debug a process using gdb without pausing it?"
The Linux kernel provides some support for this via PTRACE_SEIZE, but gdb doesn'...
- 1,724
5
votes
1
answer
2k
views
Huawei HG8245H, can't read some system files
I have modem Echolife HG8245H (V3R016C10S150). I'm using telnet to connect it. I need to read some files from this modem. There's a shell mode I can enter, but it is nerfed badly:
SU_WAP>shell
...
- 91
5
votes
0
answers
896
views
Python library for linux to demangle MSVC decorated names
I am looking for a python library for linux which can demangle the function names which are mangled by MSVC.
for example :
Project!??0?$allocator@D@std@@QAE@XZ
to
Project!public: __thiscall
...
- 265
4
votes
0
answers
106
views
How to assemble back a disassembled Linux kernel?
I have a Linux kernel file and I need to tweak the contents of its corresponding initramfs. I did it in the past for standard distros where kernel and initramfs were separate. However, this specific ...
- 141
4
votes
0
answers
339
views
Modern equivalent to rsymtab for reconstructing symbol table for statically linked / stripped binaries?
I'm working with a 32-bit ELF binary that (I believe) has been statically linked against a few different third-party libraries. It has also been stripped, so I don't have much to go on with respect to ...
- 91
3
votes
0
answers
36
views
Linux persistance between runs of program but not between reboots
I am working on reverse-engineering a linux program with a function that reads in configuration information from a file, and then passes this information to the program. However, after I fully exit ...
- 31
3
votes
0
answers
284
views
Problem getting root shell on Ezviz camera
I got a CS-C6N Ezviz camera. My friend gave it to me because he doesn't use it anymore. I was able to get rtsp stream from the camera (but laggy), and I also was able to connect to UART port on the ...
- 239
3
votes
0
answers
104
views
Setting a breakpoint on a shared library's decompiled exported function, and making Ghidra actually stop on that function when debugging a client code
I am very new to Ghidra, so please accept my apologies if my question sounds too simple. Despite the poor quality of the Internet in my country, I tried my best to find an answer online before asking ...
- 31
3
votes
0
answers
328
views
Steghide Linux Steganography how to get "Passphrase"
I am currently on Parrot Linux and have an image has a hidden steganographic inside.
I know I need to decode it with Steghide in the Parrot Terminal.
I also know that I will find out what the hidden ...
- 51
3
votes
0
answers
109
views
methods for identifying deliberately unmagiked filesystem
I am trying to restore a system from backups around some obnoxious copy protection. It is a Linux system from an vendor that does not appear to comply with the GPL and has overwritten the header of ...
- 131
3
votes
1
answer
1k
views
Cannot open '/proc/.../maps': No such file or directory in radare2 debug mode
When I try to load a program to radare2 debug mode, most of the time I get the following error:
$sudo r2 -d a.out
Hello world!= attach 2851 2851
Cannot open '/proc/2851/maps': No such file or ...
- 153
2
votes
0
answers
44
views
Booting a Linux kernel ARM64 boot executable Image
I am self learning reverse engineering and working on reversing a firmware image for an unknown ioT device that's running on Zephyr. I have the firmware image (.img file), which returns 'Linux kernel ...
- 21
2
votes
0
answers
129
views
Cannot load libvulkan.so on Linux chroot running on Android while normal Android apps can load it
Environment
First I will give a quick summary of my environment
Device: Samsung Galaxy M20 (m20lte)
SoC: Exynos 7904 (with Mali-G71 GPU)
OS: Android 10 (Stock ROM with root using Magisk)
Kernel: 4.4....
- 239
2
votes
0
answers
152
views
What hints can x86 disassembly give as to GCC/G++ compiler version and options?
I've taken an interest to disassembling binaries and attempting to recreate 1:1 source code (logic) in C and C++ compiled with GCC. I say "logic" because this question does not pertain to ...
2
votes
0
answers
4k
views
Extracting ZTE F670L router's config.bin file
I want to enable telnet in my router (ZTE F670L V9.0.11P1N20D), So, I backup my router and i have a file config.bin, Size 23.5KB. I fired up kali and when i issue this command:
$ file config.bin
...
- 21
2
votes
0
answers
107
views
Edit Squashfs filesystem in flash memory
I have read Flash memory and analyze with binwalk and find out Squashfs that I can extract with dd and open with unsquashfs .
When I open this FS I want to add some file into this FS and edit some ...
2
votes
0
answers
390
views
Passing a String into a Function With GDB
So, I have a function with the prototype according to GDB:
{std::string (std::string)} 0x56027729e545
<function(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator&...
- 21
2
votes
0
answers
590
views
Repacking vmlinux into zImage/bzimage
While RE an embedded device I ran into a problem - I need to patch a check in the kernel which has no sources available. Unpacking the kernel and binary-patching went smoothly. However I cannot get ...
- 163
2
votes
0
answers
202
views
Why PTRACE_POKEDATA returns I/O error?
I learning usage of ptrace.
I tried following simple example but raises a I/O Error.
I would like to overwrite "Hello, world" (printing string) from other process.
A target program prints &...
- 141
2
votes
0
answers
344
views
Shellcode execution segfault
I have been trying to exploit simple buffer overflow caused by scanf. I'm working on x86 Linux. The point is to spawn a shell. I sucesfully overwritten return address and jumped into my shellcode. But ...
- 21
2
votes
0
answers
184
views
submitting input into AFL fuzzer
I have some questions about the AFL Fuzzer:
How does the AFL Fuzzer know where to inject the payload in the code I compile? For instance if I want to inject it in a specific parameter, how do I do it?...
- 71
2
votes
0
answers
1k
views
Extracting firmware image from binary
I have firmware file in .bin format, but I need get firmware.img image file and Kernel uImage file for reflashing bricked device. How can I get these parts?
I used Binwalk to extract content, ...
- 215
2
votes
0
answers
279
views
IDA remote debugging - non printable characters in parameters
I am trying to remote debug a certain binary which gets user-specified command line arguments, which can be non-printable of course.
My goal is the ability to debug with IDA the process with the ...
- 43
2
votes
0
answers
1k
views
Passing input to program in Remote Debugging with IDA Pro
I am writing an exploit for a binary on Linux using IDA Pro. This binary, first accepts an input using getchar() and after few more code sections, it accepts a buffer as an input through stdin and it ...
- 765
2
votes
0
answers
715
views
Obscure router refuses to flash OpenWrt
This is a very obscure Chinese router from a brand called Wavlink. It's the Model: WN529R2/WN529R2P. It's web interface was pretty limited and wouldn't allow firmware modifications.
I found GND/Tx/Rx/...
- 154
2
votes
0
answers
1k
views
open a non-standard compression .tar.lzma file extracted from firmware download
We are trying to examine a firmware download for a product we have running on our local network. Using the command
binwalk -Me filename
we generated a folder that contains the following content:
...
2
votes
0
answers
131
views
Trace replayer won't load binary debug information
So I'm debugging a linux application with what I believe DWARF debug information on x86-64 host. Everything is working fine and as expected - the source files are loaded immediately on function ...
- 445
2
votes
0
answers
2k
views
How to set-up GDB debugging in IDA Pro on Linux via Wine?
I tried running on linux via root terminal:
gdbserver --multi localhost:23947
And then at IDA Pro at Wine I use Remote GDB debugger with my local ip and port:
However when I start debugging I think ...
- 411
2
votes
0
answers
187
views
How can one debug a program that can only be started by other processes?
I am now trying to figure out the innards of a custom made program that I've found difficult to debug using a debugger.
The program starts by using a bash script wrapper to process input parameters, ...
2
votes
0
answers
703
views
Flashing NVRAM with U-Boot 1.2.0
I tried to program SPI Flash NVRAM (S25FL064A) from U-boot, but it not allow to write:
tftp 0x80000100 nvram.bin
cp.b 0x80000100 0x007b0000 0x00050000
There is no error shown after cp.b command, ...
- 203
1
vote
0
answers
26
views
How to develop an anti-debug library which allow users to debug their own programs but not the library?
I'm going to publish a library which guarded by anti-debug ,(ptrace_trackme for Linux and isDebuggerPresent for windows).
The down side of this library is: users would be abled to debug their own ...
- 81
1
vote
0
answers
22
views
ZTE F670 V1.1.10P3T21 encrypted config.bin
I want to decrypt config.bin
For this I found in cspd
following code
undefined4 CspDBInitPdtInterface(undefined4 *param_1)
{
dbAddCfgItem(0xffff,0,"/userconfig/cfg/db_user_cfg.xml");
...
- 11
1
vote
0
answers
41
views
Where can I get source code for ASCII graph parser?
My plan is to see source code graph in vim of doxygen.
I almost use TUI on Linux.
So, Where can I get C, Python based source code for ASCII graph parser?
- 21
1
vote
0
answers
28
views
Using rbreak without import functions
While debugging with GDB I want to break for each function and print the PC register.
rbreak .
define hook-stop
i r $PC
c
end
The problem is that is stop on functions that imported like printf ...
1
vote
0
answers
85
views
How can I determine the bluetooth commands needed to communicate with my smart scale via bluetooth using my computer?
I have a Tanita-BC401 smart scale. This scale pairs with the "My Tanita" app via Bluetooth.
I have enabled the "Bluetooth HCI Snoop Log" developer option in my Android phone and ...
- 11
1
vote
0
answers
55
views
parallel NAND flash dumped with dd mtd0-12
Hi hope some one can help i have tried dumping nand on a system in u-boot with the dd command so i have mtd0-12 but have now messed up bootloader now i have non booting device/brick. i have tried jtag ...
- 11
1
vote
0
answers
100
views
Launching Linux kernel on UART serial interface, but can't login because key-mappings change randomly
I am trying to root an old Linux device I have, it uses the CFE bootloader by Broadcom. I know the username and the password, but something really strange happens when I try to login.
I get a prompt ...
- 263
1
vote
0
answers
67
views
Handle Ioctl call while running with qemu
I am using qemu to emulate a binary like this
qemu -strace XXXXX .
I saw that the first 2 system calls of this process were TCGETS to stdin and stdout. From man pages
Get and set terminal attributes
...
- 21
1
vote
0
answers
217
views
Why IDA debugger keep receiving SIGTRAP or SIGSEGV after set a break-point and then deactivated that break-point
Here's the problem:
I set a breakpoint in IDA debugger
the program stop at the breakpoint
deactivated the breakpoint
IDA keep receiving SIGTRAP or SIGSEGV
( program stop at breakpoint as expected ) :...
- 131
1
vote
0
answers
153
views
Replacing bytes from start of every function with IDA Pro
I want to fix a .plt segment in IDA Pro by replacing 12 bytes from start of every function in the .plt segment with the ones I specify.
I want to just make each function return so I'm replacing ...
- 73
1
vote
0
answers
86
views
Same USB packet (Python/user vs C/kernel) but different result
I'm making a Linux module (my first one) for a closed-source, enclosed (no hardware access) device.
Using Wireshark I found what to send and where, so I tried the following command in user space ...
- 11
1
vote
2
answers
190
views
Is address in program can change
I talking about linux arch.
When I open program in Ida (statically ) I can see all instructions address like 0x20da mov r8 r2
When I want use that address to breakpoint (for example with ptrace or ...
1
vote
0
answers
40
views
Format of Alcatel_Lucent I-240W-A backup file
I am trying to modify the backup file of this router in order to change some configurations.
Here is the structure I have until now:
16 bytes of the header, zlib compressed xml with the ...
- 311
1
vote
0
answers
257
views
IDA shows MEMORY or unknown references on C std library calls (memset, memcpy, etc.)
I'm currently reversing a Linux 32-bit executable (with a statically linked library included in it) but I'm having a little problem I can't find a solution for.
Basically whenever I stumble across a ...
1
vote
0
answers
658
views
Extract files of a SquashFS Filesystem
I already asked a similar question but after a deeper analysis of the filesystem I found out that I misunderstood the problem and that's why I decided to delete the old question and make a new one.
I ...
- 108
1
vote
0
answers
247
views
Decrypt ibt.sfi linux firmware(Intel Wireless 8265 Linux Bluetooth)
Why I want to decrypt:
Intel 8265 Bluetooth is likely a RAMUSB device, which needs system to update firmware. I try to transplant this linux firmware to macOS.
Problems I met:
The macOS BT firmware ...
- 11
1
vote
0
answers
3k
views
Executing MIPS binaries on Ubuntu Linux
I have a 32-bit MIPS binary and I'm trying to execute it on Ubuntu 64-bit.
file command for the binary shows:
bin: ELF 32-bit MSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), dynamically linked (...
- 765
1
vote
0
answers
2k
views
Reverse Engineering Linux Core Dump
I have a Linux Core Dump file for a binary (which apparently crashed during execution)
file command on the core dump:
core.123: ELF 64-bit LSB core file x86-64, version 1 (SYSV), SVR4-style, from '/...
- 765
1
vote
0
answers
205
views
Immunity error BB010002
I am trying to make this exploit work and having some difficulty.
So I skipped to a 'fixed' version of it from here and the only thing I changed was the shell code:
https://github.com/cokebottle/oscp-...
- 11