Questions tagged [linux]
A free and open source POSIX compatible operating system with a monolithic kernel and a kernel module system. Originally created by Linus Torvalds.
330
questions
123
votes
2
answers
94k
views
How to handle stripped binaries with GDB? No source, no symbols and GDB only shows addresses?
I have GDB but the binary I want to reverse engineer dynamically has no symbols. That is, when I run the file utility it shows me stripped:
ELF 64-bit LSB executable, x86-64, version 1 (SYSV), ...
- 10.8k
85
votes
3
answers
128k
views
How are the segment registers (fs, gs, cs, ss, ds, es) used in Linux?
I try to understand the process of memory segmentation for the i386 and amd64 architectures on Linux. It seems that this is heavily related to the segment registers %fs, %gs, %cs, %ss, %ds, %es.
Can ...
- 18.7k
47
votes
8
answers
33k
views
How do I add functionality to an existing binary executable?
I want to add some functionality to an existing binary file. The binary file was created using gcc.
Do I need to decompile the binary first, even though I sufficiently understand the functioning of ...
- 2,435
36
votes
5
answers
10k
views
How can I analyse an executable with no read permission?
I have a binary on a Linux (Kernel 2.6) which I can execute, but can't read (chmod 0711). Therefore no static analysis is possible.
user1: $ ls -l bin
-r-s--x--- user2 user1 bin
user1: $ file bin
...
- 3,039
29
votes
5
answers
53k
views
What is the linux equivalent to OllyDbg and Ida Pro?
What is the Linux equivalent to OllyDbg and IDA Pro ? Or if there are multiple tools that do the various functions that OllyDbg and IDA Pro do, where can I find these tools? I'd like to start ...
- 423
23
votes
2
answers
14k
views
How to reverse engineer simple usb device [windows -> linux]
I'd like to reverse engineer my usb beer-can refrigurator, which does connect via USB on windows and via simple GUI tray-tool can set/query temperature.
I was thinking about running virtualboxed ...
- 231
21
votes
3
answers
18k
views
Detecting tracing in Linux
Under Linux it's possible to trace exactly the kernel system calls with strace.
ltrace can be used also to trace library calls.
I wonder if it's possible to detect if my executable is running under ...
- 4,755
20
votes
2
answers
5k
views
Why are GOT and PLT still present in Linux static stripped binaries?
I am looking at statically linked linux x86 stripped binary. I noticed that there are .got and .plt sections.
I wonder what does a statically linked binary need got and plt sections for ? Anyone ?
- 603
19
votes
2
answers
34k
views
Managing inputs for payload injection?
I am looking for a complete list of the ways to inject a payload in a vulnerable program in a Unix (Linux) context depending on the inputs opened by the program.
I know that there are several tricks ...
- 18.7k
18
votes
1
answer
4k
views
Debugging with radare2 using two terminals
I have been trying to figure this out for quite some time now, and would really need some help. Firstly, some intro:
I am running the newest version of radare2 from Github on a 64bit Ubuntu 16.04 and ...
- 1,053
16
votes
4
answers
168k
views
Converting assembly code to c
I have the following assembly code over Linux distro:
# using the .data section for write permission
# instead of .text section
.section .data
.globl _start
_start:
# displaying some characters ...
- 311
13
votes
3
answers
10k
views
Locating Linux Kernel Symbols on ARM
Igor posted a great answer previously on SO about the format of the Linux kernel image on ARM.
Assuming I can't boot my kernel image, can someone give me pointers on finding this compressed symbol ...
- 4,026
12
votes
2
answers
10k
views
How does glibc malloc work?
Wishing to dig in the internals of dynamic memory allocation on Linux, the best I could find is an article titled Understanding glibc malloc. The explanation, though detailed, is not quite ...
- 1,311
12
votes
3
answers
4k
views
Hooking functions in Linux and/or OSX?
I want to hook functions in a library (lib.so or lib.dylib) from another process. I know that unlike windows libraries, libraries in Linux and Mac still have their symbols (function names and ...
- 121
12
votes
1
answer
5k
views
How are stripped shared libraries linked against?
Lately I've been reversing the Android framework for the Nexus S mobile phone.
99% of the source code is of course open, but there are few propriety shared libraries which needs to be downloaded in ...
- 4,755
12
votes
1
answer
5k
views
Understanding the most recent heap implementation under Linux
A few days ago, I was wondering how one could teach himself heap-based overflow exploitation.
So I searched through documentation, subsequently practicing what I read in order to have a better ...
- 307
11
votes
4
answers
8k
views
How can I generate a call graph from an unstripped x86 Linux ELF?
There's a piece of software, for which I only have the binary, not the source code. It's:
unobfuscated (so, not polymorphic or anything. It is optimized a bit, though)
unstripped
x86 32 bit
...
- 281
11
votes
3
answers
22k
views
ZTE encrypted backup config file
I was poking around in ZTE Speedport Entry 2i (CPE used mostly in Germany, Slovakia etc, probably custom made for Deutsche Telekom). It's possible to download backup of config from UI.
I found out ...
- 271
10
votes
3
answers
4k
views
Why does the function pointer get overwritten even though is declared before the vulnerable buffer?
I am working on io-wargames for fun right now, level3:
I do understand why there is a stack-overflow in this code (strlen(argv[1])), but what I don't understand is why it overflows the function ...
- 657
10
votes
1
answer
17k
views
Setting a breakpoint at system call
I want to modify my teamspeak server (linux), I'm particulary interested in the connection with clients (UDP), so I figured I need to set a breakpoint at the linux socket function to start reversing. ...
- 177
10
votes
2
answers
3k
views
Attaching GDB to a specific fork
I am trying to reverse engineer a Linux binary that makes several fork() calls. I am using GDB 7.5 on Ubuntu. What I am trying to do with GDB is attach to a certain fork() (say the second call). Is ...
- 369
10
votes
2
answers
14k
views
Which python library for parsing Linux ELF files?
I want to be able to parse 32 and 64 bit ELF files - but not create or modify them (e.g. as discussed in this thread). The ELF binaries may possibly come from embedded Linux systems, that is, the ...
- 1,518
10
votes
1
answer
5k
views
Reverse Engineering ZyXel C1100Z modem firmware
first time post so please bear with me.
For days I have been trying to bypass a password my ISP has added to their remote CLI with no luck.
I have a Zyxel C1100Z DSL modem that I've purchased from ...
- 301
10
votes
4
answers
4k
views
How can I get a running thread's start address on linux?
Problem Statement
I'm trying to get the address of a running thread's start_routine as passed in the pthread_create() call.
Research so far
It is apparently not in /proc/[tid]/stat or /proc/[tid]/...
- 211
9
votes
2
answers
18k
views
ARM64 syscalls table
I wonder if there some syscall table for Linux ARM64 architecture?
I found syscall table for Linux ARM32 and many other architectures, but the problem still exists.
Does anyone know where can I find ...
- 93
9
votes
2
answers
25k
views
How to reverse engineer a Linux executable to find the parameters? [closed]
So I am on a Linux box with an executable.Vague - I know. This is what happens when I try and run it with an argument/parameter:
me@there:~$ ./theFile theOption -a
./theFile : option requires an ...
- 221
9
votes
2
answers
15k
views
Why does `ldd` and `(gdb) info sharedlibrary` show a different library base address?
I see three different outputs for where libc should be loaded.
ldd shows the loading address of libc at 0xf7e9e000
$ ldd ~/my_tool
linux-gate.so.1 => (0xf7ffe000)
libc.so.6 => /lib/...
- 3,039
9
votes
3
answers
3k
views
Did somebody start to reverse engineer the proprietary Linux Brother Cups drivers?
I'm not very experienced with graphic or printer formats. My first (and only try yet) was to print a Tux.png with 265 x 314 pixel via the Chromium browser and see what Wireshark shows as USB transfer.
...
- 191
9
votes
1
answer
920
views
Understanding segment prefixes in assembly for Linux
In looking at some assembly, I have come across a few instructions using segment prefixes. For example
<address>: .... mov eax,DWORD PTR gs:0x20
I understand the basics of memory segments, ...
- 91
9
votes
2
answers
7k
views
How to do debug a running java process in linux?
TLDR I want to do live debugging of a java program on a linux machine, and don't how/what debugger to attach to the JVM to get this done.
I expect that this is a well-solved problem, but I lack the ...
- 91
9
votes
1
answer
6k
views
How to unpack manually an upx packed elf file
I am trying to learn to manually unpack an upx packed elf file. The examples I have found are for Windows, mostly with Ollydbg, and as I see the first step is to look for pushad and popad instructions....
- 867
8
votes
4
answers
14k
views
How to check if an ELF file is UPX packed?
I have an ELF file and want to know if it is UPX packed. How can I detect UPX compression in GNU/Linux?
- 527
8
votes
2
answers
5k
views
Base address of shared objects from ldd output
I'm on a Linux machine with ASLR disabled. Running ldd on a binary gives me the following result :
linux-gate.so.1 => (0xb7fe1000)
libc.so.6 => /lib/i386-linux-gnu/libc.so.6 (0xb7e5c000)
/lib/...
user1743
8
votes
1
answer
874
views
Why are values passed through useless copies?
So, say that I have the following code, which gives three examples of what I believe to be unnecessary copies of values.
mov QWORD PTR [rbp-0x18],rdi
mov rdx,QWORD PTR [rbp-0x18]
lea rax,[...
- 285
8
votes
2
answers
11k
views
OTOOL alternative for linux
I have a reverse engineering set up on a Mac machine. This set up does some reverse engineering on iOS applications(.ipa files). I'm migrating the setup from Mac to a linux machine.
Currently on Mac, ...
- 233
8
votes
3
answers
840
views
Extracted router file execution
I am trying to run an executable file that I dug out from an extracted file system of a DSL modem router. So first of all I needed to either have a MIPS Linux box or take the emulation path. After ...
- 81
7
votes
2
answers
306
views
How should I go about trying to figure out the programming language that was used?
I have an executable file and I would like to figure out which programming language was the source code written in. The first step would be to use a disassembler.
What should be done after that ?
...
- 2,435
7
votes
3
answers
6k
views
unpack Clear spot .bin firmware update
I am trying to unpack a clear spot firmware update
The firmware I am trying to reverse can be found on the download page of the vendor
I have used the fwtools to unpack the firmware as described on ...
- 71
7
votes
3
answers
3k
views
Debugging forked child in an anti-debug protected crackme
I am interested in the anti-debugging method implemented in the crackme called trace-p. A child process is forked, which communicates with the parent using int3 instructions. I would like to debug the ...
- 867
7
votes
1
answer
429
views
How can I check I've moved outside the stack without triggering a protection fault?
I'm adding a feature to my Linux debugger (I'm using Ptrace to manipulate the traced process as well as libbfd/libopcodes) to unwind the stack and determine if discrepancies exist between each CALL's ...
- 1,213
7
votes
1
answer
1k
views
How does API call work on Android (NDK)?
In windows platform, an application usually references its IAT(Import Access Table) to get the address of the APIs it wants, then call it. Then some mechanisms are done as demonstrated here nicely.
...
- 331
7
votes
1
answer
2k
views
Calling fgets while debugging under IDA Linux
I have _fgets call in a program I want to debug in IDA. My program receives SIGTTIN while calling it, that's normal. But when I mark to pass SIGTTIN to application, program waits for input in terminal,...
- 171
7
votes
2
answers
2k
views
32-bit binary stack layout on a x64 Linux OS
Stack layout is well documented in many ways. Especially for x86 systems as there were numerous tutorials on how to exploit stack overflow on old 32-bit systems many years ago.
So far we can know ...
- 307
6
votes
3
answers
6k
views
RE Compressed backup file,router linux based so is it compresed with zlib?
so I have backup from my router its zte zxv10h201l and its linux based but I can not identify type of compression of this file.
Here is couple of first "lines" of it
00000000 99 99 99 99 ...
- 505
6
votes
3
answers
2k
views
Reversing self-modifying code
I am learning reversing an I am studying a code, which modifies itself (actually it is a crackme).
It contains statements like: movw $0xc031, 0x(%edx), where edx contains the address of a statement. ...
- 867
6
votes
3
answers
11k
views
Packers/Protectors for Linux
I was wondering if anyone had come across a packer/protector which could be used for ELF binaries. There seem to be quite a few articles on writing packers and protectors for the PE format -- however, ...
user1743
6
votes
1
answer
4k
views
Why have two symbols tables?
Why have two symbol tables if .symtab already contains everything that's in .dynsym ?
- 85
6
votes
3
answers
8k
views
How to SUCCESSFULLY add a code section to an executable file in Linux?
I am in Linux, and I have seen this question a few times but never, nobody answered how to really make this work.
I need to add a section to an already compiled binary. Lets say for a moment is an ...
- 233
6
votes
3
answers
10k
views
Use Android Shared library (.so) files in Linux
I decompiled an APK file,and that program have native codes in a .so file.
I want to use that .so file in Linux in order to use inline functions.
These codes have functions to connect to a server and ...
- 61
6
votes
3
answers
6k
views
Help reversing end-of-life'd Logitech Link. How to get Flash Contents
See Update below.
I got an email from Logitech that they are End of Lifing their Harmony Link product (see https://community.logitech.com/s/question/0D55A0000745EkCSAU/harmony-link-eos-or-eol).
So I ...
- 465