Questions tagged [linux]

A free and open source POSIX compatible operating system with a monolithic kernel and a kernel module system. Originally created by Linus Torvalds.

Filter by
Sorted by
Tagged with
4
votes
2answers
3k views

How to SUCCESSFULLY add a code section to an executable file in Linux?

I am in Linux, and I have seen this question a few times but never, nobody answered how to really make this work. I need to add a section to an already compiled binary. Lets say for a moment is an ...
4
votes
2answers
2k views

Debugging forked child in an anti-debug protected crackme

I am interested in the anti-debugging method implemented in the crackme called trace-p. A child process is forked, which communicates with the parent using int3 instructions. I would like to debug the ...
4
votes
2answers
87 views

Can i trap SIGSEGV (on a linux) and what are are the conditions to make it works ? (for a crackme)

Friendly greetings ! I'm writing some crackmes.one challenge and i want to write a challenge where the solution appears on a segmentation fault. (And you have to disassemble the code to find a way ...
4
votes
2answers
2k views

IDA Pro converting to instruction functionality: how to automate.

I am loading various files that read into IDA as binary. Once I have the GUI in front of me I am able to go through the segments and hit "c" in order to convert to instruction/code. However, I am ...
4
votes
1answer
1k views

TP-Link encrypted backup file TX-VG1530

I have been trying to wrap my head round this stuff so bear with me. I have a Tp-Link TX-VG1530. From the gui you can download the config file however the file is encrypted, I include a portion of ...
4
votes
1answer
358 views

Need help with a USB gaming mouse

I have a Chinese USB gaming mouse (04d9:a070) which has 4 color modes and 4 light levels. I know for a fact that this mouse is capable for showing at least 5 different color so it must be an RGB led (...
4
votes
1answer
4k views

How to disassemble/run mips ELF file ? (with readelf error)

So i want to disassemble and then run a MIPS elf file for the first time. As i don't have MIPS hardware i am using mipsel-unknown-linux-gnu toolchain.Here comes the problem. The output of the command ...
4
votes
1answer
1k views

/proc/self/maps equivalent on windows

I see that inspecting /proc/self/maps on Linux machines lets me see the pages that have been mapped in. As a result I can write a program to read and parse the pages it has mapped in. How could one ...
4
votes
1answer
1k views

Merging elf shared-objects

Let say I have libA.so and libB.so, is there any way for me to combine them into a single shared library libC.so that contains all exported symbols of both libA.so and libB.so?
4
votes
1answer
510 views

Changing parameter of function call in ELF executable

I want to alter a ELF executable function call and replace one of it's parameters. The executable calls dlopen() function and passes RTLD_NOW as the flag parameter. I want to change it to RTLD_LAZY. ...
4
votes
1answer
2k views

Illegal Instruction on sample Buffer Overflow exploit

I have followed the example here. Here is my sample program, "oldskool.c": #include <string.h> void go(char *data) { char name[64]; strcpy(name, data); } int main (int argc, char **...
4
votes
2answers
246 views

Extracted router file execution

I am trying to run an executable file that I dug out from an extracted file system of a DSL modem router. So first of all I needed to either have a MIPS Linux box or take the emulation path. After ...
4
votes
0answers
657 views

Python library for linux to demangle MSVC decorated names

I am looking for a python library for linux which can demangle the function names which are mangled by MSVC. for example : Project!??0?$allocator@D@std@@QAE@XZ to Project!public: __thiscall ...
3
votes
2answers
2k views

How to stop debugger right after the execution?

I'm using /bin/true as my sample binary (without available main method): $ lldb /bin/true (lldb) target create "/bin/true" Current executable set to '/bin/true' (x86_64). (lldb) break main invalid ...
3
votes
2answers
154 views

Remote Debugging Linux Binaries - Stack Address Changes?

Do stack addresses change every time we remotely debug a Linux binary using linux_server and IDA Pro? I am using IDA Pro and remote debug a linux binary which is running on a Linux machine and I am ...
3
votes
3answers
1k views

Good Public Practice Binaries? [closed]

I'm looking for some good x86 linux binaries that cover most general vulnerabilities you would find while reversing. Does anyone have any good references to binaries that are public and available for ...
3
votes
3answers
544 views

What is “webcomp” and how does it work?

When reversing a router firmware based on DD-WRT I came across a mention of "webcomp". It seems it's used for storing internal HTML files for the web interface. What exactly it is and how can I ...
3
votes
1answer
2k views

Why are symbols with local binding present in the symbol table of my ELF files?

I found out that there are symbols with binding=LOCAL and visibility=HIDDEN in the symbol table (.symtab) of ELF executables/libraries. What are they needed for? They are not involved in the ...
3
votes
2answers
1k views

Determine Hash Method - Busybox Linux

I'm trying to figure out how an ARM-Based device running Busybox Linux is storing hashes for users in a configuration file. Basically, the system allows you to backup the entire configuration to a ...
3
votes
3answers
434 views

Need to extend the list of libraries that a shared (.so) library uses

I have a number of shared libraries calling each other (.so, ARM, Android), binary-only. I want to add logging to some functions, funcA(), ..., funcZ() defined in libsomething.so. The functions are ...
3
votes
2answers
2k views

Changing Entrypoint in ELF executable

I wrote some code that does the following: Searches for and finds an offset in a binary file to add code (looks for a sequence of 00s I can overwrite). Then, I change the entrypoint of the ELF to ...
3
votes
1answer
2k views

Can't get buffer to overflow over function pointer

I cannot get this buffer overflow exploit to work for the life of me. The source code is here. It is from the book, Hacking the Art of Exploitation. The subject here is the below struct: struct user {...
3
votes
1answer
221 views

Master of Orion and scanmem

I am looking to use scanmem to change in game credits in the new Master of Orion (2016). Steps I have taken: Install and run scanmem as root Track credits successfully using scanmem It ...
3
votes
1answer
2k views

ELF link_map when linked as RELRO

When linking a binary with -Wl,-z,relro,-z,now, all relocations are performed at start-up before passing control to the binary. Because of this, there is no need for the .got.plt segment. Normally, ...
3
votes
1answer
781 views

Radare2 debugging - How to get into lazy imported functions?

I have a linux binary that imports functions from an external library (shared object). The functions are lazy loaded and not available when rip is at @main or @entry. When i step into such a function (...
3
votes
1answer
2k views

How to rebase IDA to match GDB

I would like to debug my elf file on linux using GDB and follow the disassembly in IDA, is this possible? And if it is how would I rebase IDA to match with GDB? Thanks!
3
votes
3answers
4k views

Use Android Shared library (.so) files in Linux

I decompiled an APK file,and that program have native codes in a .so file. I want to use that .so file in Linux in order to use inline functions. These codes have functions to connect to a server and ...
3
votes
1answer
673 views

How to determine which thread implementation binary compiled with

Is it possible to determine if a binary (static or shared and not stripped) is compiled with Linuxthreads or NPTL implementation ?
3
votes
1answer
182 views

Calculating the page address a buffer belongs to

I was trying out a ROP exploit -- I'm trying to make an mprotect system call using ROP(not a libc call), to try and make the buffer executable. I tried stracing the server process and ran the exploit, ...
3
votes
2answers
1k views

Flashing firmware on an embedded device

Anyone want to help out a noob? (excuse my incorrect terminology/ knowledge) I am venturing into unknown territory. The only experience I have is rooting/flashing firmware on my phone and installing ...
3
votes
2answers
1k views

Technicolor TG799vac Modem/Router Dumping The Nand Flash

Ok, so I have been trying to dump the contents of a Technicolor TG799vac. So far I have removed the flash chip and read out the chip using the DumpFlash.py utility and used binwalk to locate the ...
3
votes
2answers
803 views

Finding a place to inject shellcode

I am following the tutorial for ROP Primer, level0. The tutorial sets the memory at the beginning of [vdso] writeable and executable and copies the shellcode there. I do not know why, but it seems ...
3
votes
1answer
704 views

using GDB and dealing with breakpoint detection

I am trying to solve a reverse engineering challenge using using gdb. I can run the program inside it but when I set a breakpoint at main then I get Program received signal SIGSEGV, Segmentation ...
3
votes
2answers
305 views

How to find location of environment variables in 64 bit binaries at runtime?

In the main function, program authors can choose to receive the char * array as a parameter to main that points to the environment variables int main(int argc, char **argv, char **envp) { ... } The ...
3
votes
2answers
457 views

IDA: Finding out what calls sendmsg

I'm trying to reverse a server executable(linux) and I need to find what calls sendmsg. Usually I can just use the xrefs in IDA, but in this case it doesn't show me anything. However, if I set a ...
3
votes
0answers
76 views

methods for identifying deliberately unmagiked filesystem

I am trying to restore a system from backups around some obnoxious copy protection. It is a Linux system from an vendor that does not appear to comply with the GPL and has overwritten the header of ...
3
votes
0answers
298 views

I want to know more about how a particular exploit works. How do I do that? [closed]

I am given a VM of a server running a vulnerable version of ProFTP and a attacker VM which exploits the server using an exploit provided with MetaSploit. I need to write a Snort rule to detect ...
2
votes
2answers
4k views

Where can I get Linux malware samples?

There have been numerous sites stated in this wonderful post that one could retrieve malware samples. However, I am having a difficult time (sorry D:) locating Linux-specific malware from those sites ...
2
votes
2answers
498 views

Find sigtrap function

I'm reversing a program that uses a lot of BREAK/int 3 (Linux). I guess that the code contains something like: void sigtrap_func(int sig) { (some stuff..) } int main() { signal(SIGTRAP, ...
2
votes
1answer
378 views

possible to rebase an ELF file?

Is there any way to rebase an ELF file? (i want to load an elf binary at 0x40000000, not at 0x08040000 which is typical base) I found this tool(prelink, http://en.wikipedia.org/wiki/Prelink), but it'...
2
votes
1answer
49 views

Correct my understanding on a basic allocation memory

Here is the function If I understand correctly: There is a buffer of size 256 bytes created (malloc) in this buffer, the first 32 bits are set to 0 (because dword designates 32bits size) the next 32 ...
2
votes
1answer
71 views

Process Immediately Killed

I'm trying to reverse an ARM executable. It's for an embedded system, but I don't have any details about the normally targeted environment. Here's what file shows: ELF 32-bit LSB executable, ARM, ...
2
votes
2answers
138 views

Step Over not working in GDB

In the function below, let's say EIP is 0x400688. Now, I want to step over the call instead of stepping inside the subroutine. 0x40067a <main+4> sub $0x20,%rsp ...
2
votes
1answer
298 views

Radare2 webui - need help setting it up

How can you set up Radare2 webui in Kali or Ubuntu or any other OS? I've tried so many different methods but none of them have worked so far. I think both of them are debian based so that might be ...
2
votes
2answers
409 views

How to dump a firmware from an old cell phone with Linux?

I have a "MiracleBox" software for GSM repairing and and old cell phone (Wiko Lubi 4) with a RD8851CL chip inside. With this MiracleBox running on Windows I can make a dump of this chip without ...
2
votes
1answer
122 views

Determining an application's library call behaviour

I have a closed source Linux library libfoo that makes calls into another closed source library libbar for additional (mostly unneeded) features. However, I can't use libbar for ethical reasons, so I ...
2
votes
1answer
603 views

Custom gdb output

Yesterday i noticed a nice output from dbg while going through a write up on the internet. As am new to dbg i googled a lot as i wanted to make dbg work similar for me. As seen below this ...
2
votes
2answers
70 views

How can I pass input to my program while debugging it with IDA

I have a program that waits for the user to enter a string input, how can I enter that string input while debugging my program with IDA?
2
votes
1answer
143 views

Help needed to extract u-boot kernel & rootfs - nxp lpc 3143 processor

I have a board where in principle aim at emulating a DVD-ROM loading iso file from a drive. This board is running a ARM CPU with 32MB of ram and has no vga output. The firmware update comes with 2 ...
2
votes
1answer
476 views

extract zImage from MS-DOS executable

I have an aarch64 kernel image with the following magic number: root@localhost:/# cat msImage|xxd -l4 00000000: 4d5a 0091 MZ.. root@localhost:/# file msImage ...