Skip to main content

Questions tagged [linux]

A free and open source POSIX compatible operating system with a monolithic kernel and a kernel module system. Originally created by Linus Torvalds.

Filter by
Sorted by
Tagged with
0 votes
1 answer
422 views

Adding a program header to ELF

I am a newbie in this, and I am trying to add a program header to a simple ELF64 "Hello World" program on Ubuntu. All in changing the binary data of the ELF. I went to the end of the program ...
8 votes
2 answers
14k views

OTOOL alternative for linux

I have a reverse engineering set up on a Mac machine. This set up does some reverse engineering on iOS applications(.ipa files). I'm migrating the setup from Mac to a linux machine. Currently on Mac, ...
0 votes
1 answer
136 views

S30+ Game Development

How can I get started developing games for the S30+ operating system on Windows or Linux? I have a new nokia 150, which seems to run the correct operating system, although I'm not sure if this phone ...
1 vote
1 answer
30 views

IDA Remote Debugging and automatically interaction with the process

I am learning IDA and currently working with the debugger. In particular, I want to automate the interaction with my remote binary (from Windows Subsystem Linux - Ubuntu 22.04 instance), like what I ...
0 votes
1 answer
116 views

Router shadow password generation

I'm reverse engineering a router, I'm fairly new to embedded devices and how Linux boots up, but I have a root UART shell, there's already a password hash in the /etc/shadow file, these passwords/...
3 votes
0 answers
79 views

gain root access to my camera monitor

Edit: I managed to dump the firmware and obtained the root password hash, but there are two hashes. I successfully cracked one, resulting in helpme, but the other one might take a while. However, user:...
1 vote
2 answers
313 views

Is address in program can change

I talking about linux arch. When I open program in Ida (statically ) I can see all instructions address like 0x20da mov r8 r2 When I want use that address to breakpoint (for example with ptrace or ...
0 votes
1 answer
2k views

Dynamic Analysis on ELF using IDA

On Linux, while generally reversing ELF files and dynamic analyzing (like step into, step over, break-point, inspecting registers value, memory etc) I use gdb or radare2 which provides dynamic ...
0 votes
1 answer
360 views

How learn which functions are called in .so library at Android?

I want to learn how listen certain .so files. I mean what is the way to know which fuctions are called which body of code executed in shared library at Android? I just wanted mofify stock camera on my ...
0 votes
0 answers
38 views

NxP3143 Uboot encrypted image and roots help

I have an encrypted firmware based on 2 files uImage (kernel) and rootfs (filesystem) and I have got the encryption keys from someone who cracked it. However I don’t know where to start so I can mount ...
0 votes
0 answers
58 views

Improving the output of pseudocode C++ code from IDA Pro

I have some specific questions and some general ones about reverse-engineering a dynamic shared library via IDA Pro 8.3: If I know the compiler used and compiler flags used (via readelf --debug-dump),...
6 votes
1 answer
3k views

Huawei HG8245H, can't read some system files

I have modem Echolife HG8245H (V3R016C10S150). I'm using telnet to connect it. I need to read some files from this modem. There's a shell mode I can enter, but it is nerfed badly: SU_WAP>shell ...
1 vote
2 answers
1k views

How do I go about overriding a function internally defined in a binary on Linux?

To be specific, I cannot recompile this binary, nor do I have access to the sourcecode. The functions are not defined within a shared library. So, how can I go about changing a function, or ...
0 votes
1 answer
58 views

how to print non printable address using python

i have been doin ctf challenge and came across a problem when i have to push the address of a function into eip{instruction pointer} by overflowing the buffer but the main problem here is that the ...
1 vote
2 answers
586 views

Adding debug symbols with GDB

In CTFs when I'm given some ELF file, it usually wasn't compiled with the -g flag. Is there a way to to somehow edit the file to make it be as if the ELF file was originally compiled with the -g flag? ...
2 votes
1 answer
394 views

IDA remote debugging - non printable characters in parameters

I am trying to remote debug a certain binary which gets user-specified command line arguments, which can be non-printable of course. My goal is the ability to debug with IDA the process with the ...
1 vote
1 answer
266 views

Need help identifying this SoC

Does anybody know the manufacturer of this ARM CPU / SoC? I cannot find any information about it. I don't even know what the character in front of “Star” means. “SAV500D” seems to be the model, the ...
0 votes
0 answers
83 views

Help Extracting a CramFS filesystem from .img binary

I'm trying to extract a CramFS filesystem from a firmware binary for the FVS318Gv2. It downloads as a .zip file that can be decompressed to reveal a firmware .img file and a readme.htm. Running ...
0 votes
0 answers
66 views

Decompile or analyse injected /usr/bin/cat

I'm trying to decompile or analyse an injected Linux executable binary file /usr/bin/cat ,and find the injected code as a readable. Need some tips as a beginner how to find the injection method if it'...
1 vote
1 answer
88 views

What to do when the .img is corrupted?

After getting rejected from a promising interview process with Company A, the interviewer reached out to me and provided me with Reverse Engineering challenges Company A provides publicly to work on. ...
0 votes
0 answers
82 views

Find offset to parameter not listed in objdump in vmlinux (which contains debug symbols)

I have a series of address offsets for ubuntu that are used in a custom toolset. I'd like to build a set of offsets for another kernel, but I can't find some ubuntu offset addresses in the debug ...
2 votes
1 answer
101 views

Unix system with windows-style registry

When trying to determine the filesystem of a firmware image using binwalk, I encountered a strange combination. The binwalk is returning a lot of Unix paths, but some of them contain a typical windows-...
0 votes
1 answer
72 views

Updating legacy library in an already compiled binary

I'm dealing with a reverse engineering challenge involving a binary application that was statically compiled with a legacy library. While the legacy library is not vulnerable, it lacks certain ...
0 votes
0 answers
91 views

What are the general steps for reverse engineering a windows SPI driver for linux?

I have a fingerprint reader on my laptop that works under windows that doesn't show up on lsusb. Which means its not connected via USB. Through some digging around, I found out that this specific ...
0 votes
0 answers
39 views

NTFS files with 0 size, filestamp 01/01/1970 and "?" at the beginning of file name not deletable

I tried to backup millions of files from ext4 to an external NTFS drive. It took ages and at the end gave up, the external drive stalled. After a reboot and successful ntfsfix command I wanted to ...
1 vote
0 answers
56 views

What factors affect the base address of a shared object?

I'm looking at a CVE for an old thrift shop router that amounts to a stack based buffer overflow with no NULL characters allowed. I can control the instruction pointer register as well as a few less ...
3 votes
0 answers
1k views

Problem getting root shell on Ezviz camera

I got a CS-C6N Ezviz camera. My friend gave it to me because he doesn't use it anymore. I was able to get rtsp stream from the camera (but laggy), and I also was able to connect to UART port on the ...
9 votes
2 answers
10k views

How to do debug a running java process in linux?

TLDR I want to do live debugging of a java program on a linux machine, and don't how/what debugger to attach to the JVM to get this done. I expect that this is a well-solved problem, but I lack the ...
1 vote
0 answers
85 views

How to develop an anti-debug library which allow users to debug their own programs but not the library?

I'm going to publish a library which guarded by anti-debug ,(ptrace_trackme for Linux and isDebuggerPresent for windows). The down side of this library is: users would be abled to debug their own ...
2 votes
0 answers
329 views

ZTE F670 V1.1.10P3T21 encrypted config.bin

I want to decrypt config.bin For this I found in cspd following code undefined4 CspDBInitPdtInterface(undefined4 *param_1) { dbAddCfgItem(0xffff,0,"/userconfig/cfg/db_user_cfg.xml"); ...
2 votes
0 answers
235 views

Booting a Linux kernel ARM64 boot executable Image

I am self learning reverse engineering and working on reversing a firmware image for an unknown ioT device that's running on Zephyr. I have the firmware image (.img file), which returns 'Linux kernel ...
123 votes
2 answers
100k views

How to handle stripped binaries with GDB? No source, no symbols and GDB only shows addresses?

I have GDB but the binary I want to reverse engineer dynamically has no symbols. That is, when I run the file utility it shows me stripped: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), ...
0 votes
2 answers
851 views

Stopping at the original entry point in a packed file

During manual unpacking, the first task is to find to original entry point. The program jumps there after the unpacking is done. I took the bin/ls file, and checked with readelf -h that the entry ...
3 votes
1 answer
257 views

What is actually loaded here and different hexdump outputs on util-linux hexdump and on cutter and ghidra's hexdump

I was trying to understand what segment of file gets loaded by fourth LOAD header on phdr array. First 6 headers are shown below from readelf Program Headers: Type Offset ...
1 vote
2 answers
987 views

Run a python in command (kali) with "run" on gdb-peda$

While debugging a program under gdb with gdb-peda installed, I need to pass args to the binary using output from something like python. Why I am not getting AAAAA? gdb-peda$ b doSomthing gdb-peda$ run ...
1 vote
1 answer
73 views

Patching a B(ranch) causes segfault in ARMv7 binary, while the same patch (with JMP) works on x64 binary

Any ideas why trying to patch a ARMv7 binary causes a segfault while basically the same patch on the Win64 version of the software works as expected? Here is the Win64 version, that works UPX0:...
3 votes
0 answers
41 views

Linux persistance between runs of program but not between reboots

I am working on reverse-engineering a linux program with a function that reads in configuration information from a file, and then passes this information to the program. However, after I fully exit ...
4 votes
0 answers
212 views

How to assemble back a disassembled Linux kernel?

I have a Linux kernel file and I need to tweak the contents of its corresponding initramfs. I did it in the past for standard distros where kernel and initramfs were separate. However, this specific ...
20 votes
2 answers
6k views

Why are GOT and PLT still present in Linux static stripped binaries?

I am looking at statically linked linux x86 stripped binary. I noticed that there are .got and .plt sections. I wonder what does a statically linked binary need got and plt sections for ? Anyone ?
2 votes
0 answers
407 views

Shellcode execution segfault

I have been trying to exploit simple buffer overflow caused by scanf. I'm working on x86 Linux. The point is to spawn a shell. I sucesfully overwritten return address and jumped into my shellcode. But ...
2 votes
0 answers
507 views

Cannot load libvulkan.so on Linux chroot running on Android while normal Android apps can load it

Environment First I will give a quick summary of my environment Device: Samsung Galaxy M20 (m20lte) SoC: Exynos 7904 (with Mali-G71 GPU) OS: Android 10 (Stock ROM with root using Magisk) Kernel: 4.4....
2 votes
0 answers
8k views

Extracting ZTE F670L router's config.bin file

I want to enable telnet in my router (ZTE F670L V9.0.11P1N20D), So, I backup my router and i have a file config.bin, Size 23.5KB. I fired up kali and when i issue this command: $ file config.bin ...
4 votes
1 answer
6k views

How to decrypt the config.bin from ZTE ZXV10 H201L

I have this file from my router its backup of user config,I suppose its compresed with zlib and encrypted with AES. Utility which is resposible to compress it and encrypt it is called cspd. In side ...
5 votes
1 answer
180 views

Check if libc.so use tcache

I have ARM libc.so (GLIBC), How can I check if that libc.so used tcache, and what is the value of arena_max? Can I check that information offline?
9 votes
1 answer
8k views

How to unpack manually an upx packed elf file

I am trying to learn to manually unpack an upx packed elf file. The examples I have found are for Windows, mostly with Ollydbg, and as I see the first step is to look for pushad and popad instructions....
6 votes
3 answers
9k views

How to SUCCESSFULLY add a code section to an executable file in Linux?

I am in Linux, and I have seen this question a few times but never, nobody answered how to really make this work. I need to add a section to an already compiled binary. Lets say for a moment is an ...
5 votes
3 answers
1k views

Nested Structures in IDA

I'm trying to figure out how to explore structs in IDA, and getting stuck on the basics. I wrote a very basic test app; int main() { const int kBits = 1024; const int kExp = 3; RSA *rsa = ...
3 votes
0 answers
322 views

Setting a breakpoint on a shared library's decompiled exported function, and making Ghidra actually stop on that function when debugging a client code

I am very new to Ghidra, so please accept my apologies if my question sounds too simple. Despite the poor quality of the Internet in my country, I tried my best to find an answer online before asking ...
3 votes
0 answers
2k views

Steghide Linux Steganography how to get "Passphrase"

I am currently on Parrot Linux and have an image has a hidden steganographic inside. I know I need to decode it with Steghide in the Parrot Terminal. I also know that I will find out what the hidden ...
2 votes
1 answer
275 views

How to access files stored in mouse?

I own a Razer Mamba Elite mouse. After plugging it in to the usb port, an software installation window shows up. Basically it's the Razer software to manage device's options such as profiles, macros, ...

1
2 3 4 5
7