Skip to main content

Questions tagged [linux]

A free and open source POSIX compatible operating system with a monolithic kernel and a kernel module system. Originally created by Linus Torvalds.

80 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
9 votes
1 answer
8k views

How to unpack manually an upx packed elf file

I am trying to learn to manually unpack an upx packed elf file. The examples I have found are for Windows, mostly with Ollydbg, and as I see the first step is to look for pushad and popad instructions....
robert's user avatar
  • 887
6 votes
1 answer
3k views

Huawei HG8245H, can't read some system files

I have modem Echolife HG8245H (V3R016C10S150). I'm using telnet to connect it. I need to read some files from this modem. There's a shell mode I can enter, but it is nerfed badly: SU_WAP>shell ...
HE9CbITb's user avatar
  • 101
5 votes
0 answers
333 views

What utilities allow you to debug a process without pausing execution?

I was just reading this answer on StackOverflow, "How can you debug a process using gdb without pausing it?" The Linux kernel provides some support for this via PTRACE_SEIZE, but gdb doesn'...
Evan Carroll's user avatar
  • 1,789
5 votes
0 answers
937 views

Python library for linux to demangle MSVC decorated names

I am looking for a python library for linux which can demangle the function names which are mangled by MSVC. for example : Project!??0?$allocator@D@std@@QAE@XZ to Project!public: __thiscall ...
in3o's user avatar
  • 265
4 votes
0 answers
211 views

How to assemble back a disassembled Linux kernel?

I have a Linux kernel file and I need to tweak the contents of its corresponding initramfs. I did it in the past for standard distros where kernel and initramfs were separate. However, this specific ...
Peter's user avatar
  • 141
4 votes
0 answers
342 views

Modern equivalent to rsymtab for reconstructing symbol table for statically linked / stripped binaries?

I'm working with a 32-bit ELF binary that (I believe) has been statically linked against a few different third-party libraries. It has also been stripped, so I don't have much to go on with respect to ...
Colin's user avatar
  • 91
3 votes
0 answers
71 views

gain root access to my camera monitor

Edit: I managed to dump the firmware and obtained the root password hash, but there are two hashes. I successfully cracked one, resulting in helpme, but the other one might take a while. However, user:...
NotRin's user avatar
  • 31
3 votes
0 answers
41 views

Linux persistance between runs of program but not between reboots

I am working on reverse-engineering a linux program with a function that reads in configuration information from a file, and then passes this information to the program. However, after I fully exit ...
Enzo Damato's user avatar
3 votes
0 answers
1k views

Problem getting root shell on Ezviz camera

I got a CS-C6N Ezviz camera. My friend gave it to me because he doesn't use it anymore. I was able to get rtsp stream from the camera (but laggy), and I also was able to connect to UART port on the ...
raspiduino's user avatar
3 votes
0 answers
317 views

Setting a breakpoint on a shared library's decompiled exported function, and making Ghidra actually stop on that function when debugging a client code

I am very new to Ghidra, so please accept my apologies if my question sounds too simple. Despite the poor quality of the Internet in my country, I tried my best to find an answer online before asking ...
ElenaKarimi's user avatar
3 votes
0 answers
1k views

Steghide Linux Steganography how to get "Passphrase"

I am currently on Parrot Linux and have an image has a hidden steganographic inside. I know I need to decode it with Steghide in the Parrot Terminal. I also know that I will find out what the hidden ...
DrJacoby's user avatar
3 votes
0 answers
112 views

methods for identifying deliberately unmagiked filesystem

I am trying to restore a system from backups around some obnoxious copy protection. It is a Linux system from an vendor that does not appear to comply with the GPL and has overwritten the header of ...
hildred's user avatar
  • 131
3 votes
1 answer
1k views

Cannot open '/proc/.../maps': No such file or directory in radare2 debug mode

When I try to load a program to radare2 debug mode, most of the time I get the following error: $sudo r2 -d a.out Hello world!= attach 2851 2851 Cannot open '/proc/2851/maps': No such file or ...
Rafael's user avatar
  • 153
2 votes
0 answers
325 views

ZTE F670 V1.1.10P3T21 encrypted config.bin

I want to decrypt config.bin For this I found in cspd following code undefined4 CspDBInitPdtInterface(undefined4 *param_1) { dbAddCfgItem(0xffff,0,"/userconfig/cfg/db_user_cfg.xml"); ...
Elec Art's user avatar
2 votes
0 answers
231 views

Booting a Linux kernel ARM64 boot executable Image

I am self learning reverse engineering and working on reversing a firmware image for an unknown ioT device that's running on Zephyr. I have the firmware image (.img file), which returns 'Linux kernel ...
Mario9987's user avatar
2 votes
0 answers
503 views

Cannot load libvulkan.so on Linux chroot running on Android while normal Android apps can load it

Environment First I will give a quick summary of my environment Device: Samsung Galaxy M20 (m20lte) SoC: Exynos 7904 (with Mali-G71 GPU) OS: Android 10 (Stock ROM with root using Magisk) Kernel: 4.4....
raspiduino's user avatar
2 votes
0 answers
182 views

What hints can x86 disassembly give as to GCC/G++ compiler version and options?

I've taken an interest to disassembling binaries and attempting to recreate 1:1 source code (logic) in C and C++ compiled with GCC. I say "logic" because this question does not pertain to ...
Matthew Tingum's user avatar
2 votes
0 answers
8k views

Extracting ZTE F670L router's config.bin file

I want to enable telnet in my router (ZTE F670L V9.0.11P1N20D), So, I backup my router and i have a file config.bin, Size 23.5KB. I fired up kali and when i issue this command: $ file config.bin ...
Chirantan's user avatar
2 votes
0 answers
169 views

Edit Squashfs filesystem in flash memory

I have read Flash memory and analyze with binwalk and find out Squashfs that I can extract with dd and open with unsquashfs . When I open this FS I want to add some file into this FS and edit some ...
yfr24493AzzrggAcom's user avatar
2 votes
0 answers
124 views

How can I determine the bluetooth commands needed to communicate with my smart scale via bluetooth using my computer?

I have a Tanita-BC401 smart scale. This scale pairs with the "My Tanita" app via Bluetooth. I have enabled the "Bluetooth HCI Snoop Log" developer option in my Android phone and ...
MaxParadiz's user avatar
2 votes
0 answers
631 views

Passing a String into a Function With GDB

So, I have a function with the prototype according to GDB: {std::string (std::string)} 0x56027729e545 <function(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator&...
0x96's user avatar
  • 21
2 votes
0 answers
1k views

Repacking vmlinux into zImage/bzimage

While RE an embedded device I ran into a problem - I need to patch a check in the kernel which has no sources available. Unpacking the kernel and binary-patching went smoothly. However I cannot get ...
kiler129's user avatar
  • 163
2 votes
0 answers
382 views

Why PTRACE_POKEDATA returns I/O error?

I learning usage of ptrace. I tried following simple example but raises a I/O Error. I would like to overwrite "Hello, world" (printing string) from other process. A target program prints &...
KiYugadgeter's user avatar
2 votes
0 answers
405 views

Shellcode execution segfault

I have been trying to exploit simple buffer overflow caused by scanf. I'm working on x86 Linux. The point is to spawn a shell. I sucesfully overwritten return address and jumped into my shellcode. But ...
user32914's user avatar
2 votes
0 answers
202 views

submitting input into AFL fuzzer

I have some questions about the AFL Fuzzer: How does the AFL Fuzzer know where to inject the payload in the code I compile? For instance if I want to inject it in a specific parameter, how do I do it?...
Logan's user avatar
  • 71
2 votes
0 answers
1k views

Extracting firmware image from binary

I have firmware file in .bin format, but I need get firmware.img image file and Kernel uImage file for reflashing bricked device. How can I get these parts? I used Binwalk to extract content, ...
minto's user avatar
  • 215
2 votes
1 answer
393 views

IDA remote debugging - non printable characters in parameters

I am trying to remote debug a certain binary which gets user-specified command line arguments, which can be non-printable of course. My goal is the ability to debug with IDA the process with the ...
toothpick's user avatar
2 votes
0 answers
1k views

Passing input to program in Remote Debugging with IDA Pro

I am writing an exploit for a binary on Linux using IDA Pro. This binary, first accepts an input using getchar() and after few more code sections, it accepts a buffer as an input through stdin and it ...
Neon Flash's user avatar
2 votes
0 answers
764 views

Obscure router refuses to flash OpenWrt

This is a very obscure Chinese router from a brand called Wavlink. It's the Model: WN529R2/WN529R2P. It's web interface was pretty limited and wouldn't allow firmware modifications. I found GND/Tx/Rx/...
78dtat78da's user avatar
2 votes
0 answers
1k views

open a non-standard compression .tar.lzma file extracted from firmware download

We are trying to examine a firmware download for a product we have running on our local network. Using the command binwalk -Me filename we generated a folder that contains the following content: ...
secure to a fault's user avatar
2 votes
0 answers
132 views

Trace replayer won't load binary debug information

So I'm debugging a linux application with what I believe DWARF debug information on x86-64 host. Everything is working fine and as expected - the source files are loaded immediately on function ...
rec's user avatar
  • 475
2 votes
0 answers
2k views

How to set-up GDB debugging in IDA Pro on Linux via Wine?

I tried running on linux via root terminal: gdbserver --multi localhost:23947 And then at IDA Pro at Wine I use Remote GDB debugger with my local ip and port: However when I start debugging I think ...
sasho648's user avatar
  • 421
2 votes
0 answers
190 views

How can one debug a program that can only be started by other processes?

I am now trying to figure out the innards of a custom made program that I've found difficult to debug using a debugger. The program starts by using a bash script wrapper to process input parameters, ...
Disenchanted Toad's user avatar
2 votes
0 answers
712 views

Flashing NVRAM with U-Boot 1.2.0

I tried to program SPI Flash NVRAM (S25FL064A) from U-boot, but it not allow to write: tftp 0x80000100 nvram.bin cp.b 0x80000100 0x007b0000 0x00050000 There is no error shown after cp.b command, ...
Lexx Luxx's user avatar
  • 203
1 vote
1 answer
23 views

IDA Remote Debugging and automatically interaction with the process

I am learning IDA and currently working with the debugger. In particular, I want to automate the interaction with my remote binary (from Windows Subsystem Linux - Ubuntu 22.04 instance), like what I ...
Anh Nguyễn Tuấn's user avatar
1 vote
0 answers
55 views

What factors affect the base address of a shared object?

I'm looking at a CVE for an old thrift shop router that amounts to a stack based buffer overflow with no NULL characters allowed. I can control the instruction pointer register as well as a few less ...
Matthew Tingum's user avatar
1 vote
0 answers
84 views

How to develop an anti-debug library which allow users to debug their own programs but not the library?

I'm going to publish a library which guarded by anti-debug ,(ptrace_trackme for Linux and isDebuggerPresent for windows). The down side of this library is: users would be abled to debug their own ...
prgbenz's user avatar
  • 81
1 vote
0 answers
45 views

Where can I get source code for ASCII graph parser?

My plan is to see source code graph in vim of doxygen. I almost use TUI on Linux. So, Where can I get C, Python based source code for ASCII graph parser?
user3881835's user avatar
1 vote
0 answers
31 views

Using rbreak without import functions

While debugging with GDB I want to break for each function and print the PC register. rbreak . define hook-stop i r $PC c end The problem is that is stop on functions that imported like printf ...
yfr24493AzzrggAcom's user avatar
1 vote
0 answers
73 views

parallel NAND flash dumped with dd mtd0-12

Hi hope some one can help i have tried dumping nand on a system in u-boot with the dd command so i have mtd0-12 but have now messed up bootloader now i have non booting device/brick. i have tried jtag ...
Bob smith's user avatar
1 vote
0 answers
128 views

Launching Linux kernel on UART serial interface, but can't login because key-mappings change randomly

I am trying to root an old Linux device I have, it uses the CFE bootloader by Broadcom. I know the username and the password, but something really strange happens when I try to login. I get a prompt ...
Jeremy's user avatar
  • 263
1 vote
0 answers
82 views

Handle Ioctl call while running with qemu

I am using qemu to emulate a binary like this qemu -strace XXXXX . I saw that the first 2 system calls of this process were TCGETS to stdin and stdout. From man pages Get and set terminal attributes ...
Lpoiu0099's user avatar
1 vote
0 answers
339 views

Why IDA debugger keep receiving SIGTRAP or SIGSEGV after set a break-point and then deactivated that break-point

Here's the problem: I set a breakpoint in IDA debugger the program stop at the breakpoint deactivated the breakpoint IDA keep receiving SIGTRAP or SIGSEGV ( program stop at breakpoint as expected ) :...
ratsafalig's user avatar
1 vote
0 answers
180 views

Replacing bytes from start of every function with IDA Pro

I want to fix a .plt segment in IDA Pro by replacing 12 bytes from start of every function in the .plt segment with the ones I specify. I want to just make each function return so I'm replacing ...
Ronny's user avatar
  • 73
1 vote
0 answers
102 views

Same USB packet (Python/user vs C/kernel) but different result

I'm making a Linux module (my first one) for a closed-source, enclosed (no hardware access) device. Using Wireshark I found what to send and where, so I tried the following command in user space ...
PeterHerb's user avatar
1 vote
2 answers
312 views

Is address in program can change

I talking about linux arch. When I open program in Ida (statically ) I can see all instructions address like 0x20da mov r8 r2 When I want use that address to breakpoint (for example with ptrace or ...
yfr24493AzzrggAcom's user avatar
1 vote
0 answers
41 views

Format of Alcatel_Lucent I-240W-A backup file

I am trying to modify the backup file of this router in order to change some configurations. Here is the structure I have until now: 16 bytes of the header, zlib compressed xml with the ...
Fabian Mendez's user avatar
1 vote
0 answers
310 views

IDA shows MEMORY or unknown references on C std library calls (memset, memcpy, etc.)

I'm currently reversing a Linux 32-bit executable (with a statically linked library included in it) but I'm having a little problem I can't find a solution for. Basically whenever I stumble across a ...
Davide Maggioni's user avatar
1 vote
0 answers
869 views

Extract files of a SquashFS Filesystem

I already asked a similar question but after a deeper analysis of the filesystem I found out that I misunderstood the problem and that's why I decided to delete the old question and make a new one. I ...
Ramazuri's user avatar
  • 108
1 vote
0 answers
265 views

Decrypt ibt.sfi linux firmware(Intel Wireless 8265 Linux Bluetooth)

Why I want to decrypt: Intel 8265 Bluetooth is likely a RAMUSB device, which needs system to update firmware. I try to transplant this linux firmware to macOS. Problems I met: The macOS BT firmware ...
Steve's user avatar
  • 11