We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [linux]

A free and open source POSIX compatible operating system with a monolithic kernel and a kernel module system. Originally created by Linus Torvalds.

44 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
5
votes
2answers
285 views

Extracted router file execution

I am trying to run an executable file that I dug out from an extracted file system of a DSL modem router. So first of all I needed to either have a MIPS Linux box or take the emulation path. After ...
5
votes
0answers
4k views

How to unpack manually an upx packed elf file

I am trying to learn to manually unpack an upx packed elf file. The examples I have found are for Windows, mostly with Ollydbg, and as I see the first step is to look for pushad and popad instructions....
4
votes
0answers
693 views

Python library for linux to demangle MSVC decorated names

I am looking for a python library for linux which can demangle the function names which are mangled by MSVC. for example : Project!??0?$allocator@D@std@@QAE@XZ to Project!public: __thiscall ...
3
votes
0answers
163 views

How to do debug a running java process in linux?

TLDR I want to do live debugging of a java program on a linux machine, and don't how/what debugger to attach to the JVM to get this done. I expect that this is a well-solved problem, but I lack the ...
3
votes
0answers
84 views

methods for identifying deliberately unmagiked filesystem

I am trying to restore a system from backups around some obnoxious copy protection. It is a Linux system from an vendor that does not appear to comply with the GPL and has overwritten the header of ...
2
votes
1answer
26 views

IAT vs GOT address resolving: which of them resolve during runtime and which during load time by default?

So based on my knowledge on windows apps, as far as i know the IAT gets filled with correct addresses when the library gets loaded (correct me if I'm wrong) now in linux, they use GOT, and again ...
2
votes
1answer
56 views

What is actually loaded here and different hexdump outputs on util-linux hexdump and on cutter and ghidra's hexdump

I was trying to understand what segment of file gets loaded by fourth LOAD header on phdr array. First 6 headers are shown below from readelf Program Headers: Type Offset ...
2
votes
1answer
244 views

Cannot open '/proc/…/maps': No such file or directory in radare2 debug mode

When I try to load a program to radare2 debug mode, most of the time I get the following error: $sudo r2 -d a.out Hello world!= attach 2851 2851 Cannot open '/proc/2851/maps': No such file or ...
2
votes
0answers
326 views

Obscure router refuses to flash OpenWrt

This is a very obscure Chinese router from a brand called Wavlink. It's the Model: WN529R2/WN529R2P. It's web interface was pretty limited and wouldn't allow firmware modifications. I found GND/Tx/Rx/...
2
votes
1answer
563 views

Is there a way to debug an elf file that runs with no problems with damaged header?

My question is general, but to have an example to work with, let us take one from Whirlwind Tutorial. ; tiny.asm BITS 32 org 0x00010000 db 0x7F, "ELF" ; ...
2
votes
0answers
2k views

How to decrypt the config.bin from ZTE ZXV10 H201L

I have this file from my router its backup of user config,I suppose its compresed with zlib and encrypted with AES. Utility which is resposible to compress it and encrypt it is called cspd. In side ...
2
votes
0answers
768 views

open a non-standard compression .tar.lzma file extracted from firmware download

We are trying to examine a firmware download for a product we have running on our local network. Using the command binwalk -Me filename we generated a folder that contains the following content: ...
2
votes
0answers
111 views

Trace replayer won't load binary debug information

So I'm debugging a linux application with what I believe DWARF debug information on x86-64 host. Everything is working fine and as expected - the source files are loaded immediately on function ...
2
votes
0answers
252 views

Modern equivalent to rsymtab for reconstructing symbol table for statically linked / stripped binaries?

I'm working with a 32-bit ELF binary that (I believe) has been statically linked against a few different third-party libraries. It has also been stripped, so I don't have much to go on with respect to ...
2
votes
0answers
1k views

How to set-up GDB debugging in IDA Pro on Linux via Wine?

I tried running on linux via root terminal: gdbserver --multi localhost:23947 And then at IDA Pro at Wine I use Remote GDB debugger with my local ip and port: However when I start debugging I think ...
2
votes
0answers
165 views

How can one debug a program that can only be started by other processes?

I am now trying to figure out the innards of a custom made program that I've found difficult to debug using a debugger. The program starts by using a bash script wrapper to process input parameters, ...
2
votes
0answers
542 views

Flashing NVRAM with U-Boot 1.2.0

I tried to program SPI Flash NVRAM (S25FL064A) from U-boot, but it not allow to write: tftp 0x80000100 nvram.bin cp.b 0x80000100 0x007b0000 0x00050000 There is no error shown after cp.b command, ...
1
vote
0answers
97 views

Extracting firmware image from binary

I have firmware file in .bin format, but I need get firmware.img image file and Kernel uImage file for reflashing bricked device. How can I get these parts? I used Binwalk to extract content, ...
1
vote
0answers
75 views

Sniffing TCP packets using Wireshark

I am trying to reverse engineer a decoder. The decoder contains a web server that makes sending/receiving information through the Internet possible. To do so I need to sniff the packets that the ...
1
vote
0answers
80 views

Decrypt ibt.sfi linux firmware(Intel Wireless 8265 Linux Bluetooth)

Why I want to decrypt: Intel 8265 Bluetooth is likely a RAMUSB device, which needs system to update firmware. I try to transplant this linux firmware to macOS. Problems I met: The macOS BT firmware ...
1
vote
0answers
1k views

OTOOL alternative for linux

I have a reverse engineering set up on a Mac machine. This set up does some reverse engineering on iOS applications(.ipa files). I'm migrating the setup from Mac to a linux machine. Currently on Mac, ...
1
vote
0answers
364 views

Reverse Engineering Linux Core Dump

I have a Linux Core Dump file for a binary (which apparently crashed during execution) file command on the core dump: core.123: ELF 64-bit LSB core file x86-64, version 1 (SYSV), SVR4-style, from '/...
1
vote
0answers
366 views

Passing input to program in Remote Debugging with IDA Pro

I am writing an exploit for a binary on Linux using IDA Pro. This binary, first accepts an input using getchar() and after few more code sections, it accepts a buffer as an input through stdin and it ...
1
vote
0answers
147 views

Immunity error BB010002

I am trying to make this exploit work and having some difficulty. So I skipped to a 'fixed' version of it from here and the only thing I changed was the shell code: https://github.com/cokebottle/oscp-...
1
vote
0answers
108 views

Unsquashfs fails partways with gzip error code -5

I have been trying to unsquash a system.sfs file in order to modify the directories. however, unsquashfs system.sfs returns the following output: Parallel unsquashfs: Using 8 processors 1 inodes (...
1
vote
0answers
616 views

My core dump's backtrace stops to a signal handler, what can I do?

I obtained an ELF core dump that was provoked by fuzzing a proprietary server. As I do not have access anymore to the machine that hosted this server, and the server is part of a tightly coupled set ...
1
vote
0answers
183 views

X64 ASSEMBLY - Cannot run compiled and linked raw shellcode in Windows

After using metasploit's windows/x64/meterpreter/reverse_tcp shellcode on my windows 10 machine (with AVs turned off), I decided to try to create a hand-made polymorphic, null-free and custom-encoded ...
1
vote
0answers
114 views

What is the name of this technique?

A while back, on a Linux system, I found a strange binary being executed at seemingly random times with some strange arguments, briefly appearing in ps. There was nothing to be found at the usual ...
1
vote
0answers
576 views

ZyXEL P-2812HNU-F1, replacing the U-Boot on the board

I want flash regular(non branded) firmware on ZyXEL P-2812HNU-F1 router, which have branded version of firmware (customized for local MSO provider). To do this, I should first replace the U-Boot image ...
1
vote
1answer
259 views

Mechanisms to stop serial console accepting input on a Linux system?

I am working on a simple embedded system based around an Olinuxino board. This has a serial console header onboard. TX and RX are both connected to the respective pins on the microcontroller (i.e. ...
1
vote
0answers
313 views

Why the extracted content differs?

I used binwalk to extract firmware.bin image, the extracted content is squashfs-root dir, and a separate dpc.squashfs file. Then I used sasquatch utility to extract content of dpc.squashfs file, and I ...
0
votes
0answers
42 views

Bufferoverflow Stack

I want to do a buffer overflow exploit in the stack. For this i read in data via the "gets"-function. void ExploitMe() { char buffer[256]; gets(buffer); } I compile this file with gcc test.c -...
0
votes
0answers
39 views

IDA remote debugging - non printable characters in parameters

I am trying to remote debug a certain binary which gets user-specified command line arguments, which can be non-printable of course. My goal is the ability to debug with IDA the process with the ...
0
votes
0answers
26 views

Stack trace with GdbServer

When I debug binary file on linux with gdbServer with Ida ,I don't see stack trace. Why? How can I fix it to see stack trace??
0
votes
1answer
234 views

mprotect syscall not working

I want to modify the protection of the .text segment to RWX using a shellcode. In the shellcode, I can issue the syscall for mprotect however it's not working. Per the sys_mprotect definition, it ...
0
votes
0answers
445 views

Executing MIPS binaries on Ubuntu Linux

I have a 32-bit MIPS binary and I'm trying to execute it on Ubuntu 64-bit. file command for the binary shows: bin: ELF 32-bit MSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), dynamically linked (...
0
votes
1answer
128 views

Changing local variable in caller from callee in C?

I'm implementing a function which is going to perform some time-consuming task, and I'd like to hack the benchmarking part a bit by changing the variable indicating the CPU time my function has ...
0
votes
0answers
58 views

What memory security settings are needed to allow a basic buffer overflow on Fedora 25?

I'm having a rather difficult time determining what memory security settings need to be adjusted on a fresh install of Fedora 25 in order to perform basic buffer overflows in the C language. As a ...
0
votes
0answers
71 views

dlmalloc free pointers

I was looking at the implementation of "free" in my current dlmalloc(both the source and the disassembly). However, I could not find the code section the inserts the FD and BK into free chunks. What ...
0
votes
0answers
344 views

Intercepting syscall in a shared object (dynamically linked)

Ditto. Any technique that allows to intercept sys calls issued from a shared object file? At runtime, the shared object is dlopen'ed by main(). One candidate is to use static binary rewriting (e.g. ...
0
votes
0answers
117 views

Set up an interrupt handler at kernel mode

I'm looking for something (a tool?) that can help me achieve my current goal: write a driver that can momentously interrupt the execution of the operating system (Linux, in my case), let me be able to ...
-1
votes
1answer
543 views

Dynamic Analysis on ELF using IDA

On Linux, while generally reversing ELF files and dynamic analyzing (like step into, step over, break-point, inspecting registers value, memory etc) I use gdb or radare2 which provides dynamic ...
-1
votes
1answer
290 views

Practicing what SHOULD be a simple crackme. Program calls strlen() but never returns

I'm trying out a crackme from the "LSE CTF" called "Blue Box" worth only 10 points. I've attempted this inside GDB and radare2... It is very simple, takes one argument and first checks to make sure ...
-1
votes
2answers
310 views

Stopping at the original entry point in a packed file

During manual unpacking, the first task is to find to original entry point. The program jumps there after the unpacking is done. I took the bin/ls file, and checked with readelf -h that the entry ...