Questions tagged [linux]

A free and open source POSIX compatible operating system with a monolithic kernel and a kernel module system. Originally created by Linus Torvalds.

Filter by
Sorted by
Tagged with
1
vote
1answer
57 views

Does the operating system you use matter?

people recommend windows for reverse engineering, I don't want to install windows as a virtual machine because they are laggy and I already have windows 10 as host, is it possible to use linux vm that ...
0
votes
0answers
22 views

Edit IDA signal handler

In Ida Pro while debugging linux process with gdbserver I got window that show than SIGTRAP has been arrived, I choose to pass it to application. How can I edit that choose now? I want to ignore this ...
0
votes
1answer
41 views

Need help opening a .img file from a camera firmware (trying to get out of the Meari/Zumimall/PPstrong cloud!)

I've got a cloud-based battery powered camera which I'm really hoping to get out of the cloud with, in order to enable RTSP or ONVIF (or something local!). I've managed to get a .bin file. Binwalk ...
0
votes
1answer
69 views

ASLR in Linux Vs Windows

I am quite new in binary exploitation. I am doing a lot of beginners exercise here. I am confused about ASLR. I tried some binary exploitation thing in Linux. It was recommended that I should stop ...
0
votes
0answers
33 views

Exploit education stack-five: trouble getting the shell

Im trying the phoenix vm, challenge stack-five on exploit.education (http://exploit.education/phoenix/stack-five/). I run onto a problem while exploiting a stack overflow. The challenge is run execve('...
2
votes
1answer
85 views

hooking libhoudini on x86 emulator

I'm trying to hook libhoudini to debug an application instruction by instruction using frida but frida not supports it i need a example on how can this be achieved! I'm using a x86 emulator to run arm ...
1
vote
0answers
50 views

Replacing bytes from start of every function with IDA Pro

I want to fix a .plt segment in IDA Pro by replacing 12 bytes from start of every function in the .plt segment with the ones I specify. I want to just make each function return so I'm replacing ...
2
votes
1answer
90 views

Linux keyboard driver windows reverse engineering

I have toshiba portege x30-f laptop with Fn keys not working under linux. I've read some articles about usb drivers reverse engineering, but the keyboard connected not via usb. As I can understand it ...
1
vote
0answers
49 views

Same USB packet (Python/user vs C/kernel) but different result

I'm making a Linux module (my first one) for a closed-source, enclosed (no hardware access) device. Using Wireshark I found what to send and where, so I tried the following command in user space ...
1
vote
2answers
64 views

Newbie problems exploiting a format string vulnerability

I encountered a print format vulnerability challenge in a CTF. I don't know anything about these vulnerabilities, so I'm working my way through Saif El-Sherei's format string exploitation tutorial ...
1
vote
1answer
63 views

I need help reverse engineering my ereader (trying to get into the shell)

I'm trying to reverse engineer my E-Reader. It's a Denver EBO-620. I want to change the off screen image and add my own fonts. With help of Reddit I've managed to log the startup sequence (shown down ...
1
vote
1answer
96 views

Linux Embedded board - Kernel Panic problems

I need to duplicate an old embedded board based on a Yocto-based Linux. I have bought a new board with the same part number and now I need to put the old software in the new board (the new board has ...
-1
votes
2answers
58 views

Is address in program can change

I talking about linux arch. When I open program in Ida (statically ) I can see all instructions address like 0x20da mov r8 r2 When I want use that address to breakpoint (for example with ptrace or ...
1
vote
1answer
76 views

Unpacking, modifying, repacking and flashing a firmware

I've been trying to figure out how to modify the firmware on a DVR I bought for cheap recently. The built in software isn't great and doesn't offer any option for exporting video other than plugging a ...
0
votes
1answer
52 views

Find code executed on button press in Qt5 Linux application

I have an executable of a (rather simple) GUI application on Linux, built in Qt5. I am able to run it, and want to find out what happens internally when I press one of the buttons. I suspect that the ...
0
votes
0answers
47 views

Parsing C header files from DWARF Debug File

I have a Linux executable that has a linked .debug file containing DWARF debug info and I would like to find a way to parse C headers for types defined in the executable. Using gdb and ptype I can ...
0
votes
0answers
37 views

Shellcode execution segfault

I have been trying to exploit simple buffer overflow caused by scanf. I'm working on x86 Linux. The point is to spawn a shell. I sucesfully overwritten return address and jumped into my shellcode. But ...
0
votes
0answers
15 views

How to give multiple inputs to IDA when using remote linux debugger every time the program is restarted?

So this is a problem I'm facing when solving pwn CTF challenges i usually need to give many inputs for a program to reach certain point every time i restart it i tried to do it like this, by putting ...
0
votes
1answer
73 views

How can I debug open source C code for Linux?

I want to debug & reverse engineer open source code such as this project. I usually use CLion to write and debug C code on Linux. I've also used GDB. What steps do I need to take to download a ...
1
vote
0answers
183 views

Endoscope Camera YPC99 - how to stream on linux

I'm trying to stream video from endoscope camera YPC99 on linux PC using the WiFi connection. From what I have found so far the camera is using IP 192.168.1.1. It supports RTSP protocol on port 7070 (...
1
vote
2answers
211 views

Repacking an embedded initramfs

I'd like to modify some of the init scripts in an initramfs that is embedded in a kernel bzImage. I know I can modify them by not changing the size of any files (e.g. by commenting out lines, and ...
0
votes
0answers
15 views

Open all object files in Ida

I have archive file , like libc.a . When I tried to open it with ida, ida ask to choose one object file that contain in archive file. Is there any way to open all the object files in one Ida project?...
0
votes
1answer
91 views

Find all syscall in statically Arm Binary

What is the easy and fast way to find all syscall in statically Arm binary ? Is there any Ida plugin that do that?
0
votes
0answers
51 views

What does the file pointer of fgets actually point to in linux?

So i was reversing a 64 bit ELF binary, and it did a call to fgets, and based on documentation the third argument of fgets is a file pointer. now the weird part was that the third argument in this ...
2
votes
2answers
77 views

Modern methods of fuzzing/locating heap bugs and potential vulnerabilites

really glad I found this great learning resource. I was wondering, is there any way to fuzz or automate heap vulnerability assesment? I know a lot of practical frameworks for stack based fuzzing in ...
0
votes
0answers
36 views

Find common functions in arm static binary

According to Detecting libc function with IDA I have static binary for arm and I want to find common function like fread sleep printf ioctl etc. When I looking for string in this binary I found glibc ...
0
votes
0answers
221 views

a.out: Invalid ELF image for this architecture

I am trying to run arm executable using qemu and I am getting this following error a.out: Invalid ELF image for this architecture. My assemble code hello.s .text .global _start _start: mov r0, #1 ...
0
votes
0answers
89 views

Modifying a legacy uImage

I have an old device from which I extracted a uImage. I know it has a linux kernel and a cpio filesystem in the uImage, and I need to make some changes to the filesystem. I'm hoping someone can help ...
1
vote
0answers
22 views

Format of Alcatel_Lucent I-240W-A backup file

I am trying to modify the backup file of this router in order to change some configurations. Here is the structure I have until now: 16 bytes of the header, zlib compressed xml with the ...
0
votes
0answers
41 views

Address of calling syscall

With strace I can see all syscall that process call. Is there any way to know witch address of process call to this syscall?
-1
votes
2answers
200 views

How to see assembly of main function?

How can I dump the assembly of main function of binary(not striped) in ubuntu? I want to see the assembly command and the hex value of this command There are 1 binary for arm and 1 binary for x86
0
votes
0answers
45 views

Performing Buffer overflow in Linux

I have buffer overflow in a program i check(it is an array of pointers, and i can overflow the data in the first pointer), but the data i can write is not on the stack, it is on a space the system ...
0
votes
1answer
126 views

Protected shell in embedded linux

When I run telnetd -l /bin/sh on an embedded Linux device and use Putty to telnet to it, the provided shell is /bin/psh (protected shell). On this device, /bin/sh is a symbolic link to /bin/busybox. ...
1
vote
0answers
93 views

IDA shows MEMORY or unknown references on C std library calls (memset, memcpy, etc.)

I'm currently reversing a Linux 32-bit executable (with a statically linked library included in it) but I'm having a little problem I can't find a solution for. Basically whenever I stumble across a ...
0
votes
1answer
31 views

Linux encryption/luks/pymouth password scripts corruption

I noticed that the bootup scripts that collect the password for full disk encryption on linux (fedora-31) were displaying corrupted text. The kind that looked like binary data being printed at text: ...
4
votes
1answer
143 views

The buffer is too short to insert addresses when exploiting buffer overflow

Newbie here. Sorry for what you about to read . I'm currently working on exploiting a binary on Ubuntu 18.04. Here is some information about the binary: Its checksec information using pwntools: ...
2
votes
1answer
208 views

ildasm on Linux: “original” ildasm.exe same as dotnet-ildasm?

I would like to use ildasm on Linux. The original one, that comes with the .NET SDK and can be found on Windows e.g. at c:\Program Files (x86)\Microsoft SDKs\Windows\v8.0A\bin\NETFX 4.0 Tools\. I ...
1
vote
0answers
110 views

Extract files of a SquashFS Filesystem

I already asked a similar question but after a deeper analysis of the filesystem I found out that I misunderstood the problem and that's why I decided to delete the old question and make a new one. I ...
0
votes
0answers
70 views

Why does this execve shellcode work with this argv?

I wrote the following program in fasm, and am using Evan's Debugger on Ubuntu to debug it: format ELF64 executable 3 segment readable executable entry $ mov rbp, rsp sub rsp, 32 mov rax, 'this a t' ...
2
votes
1answer
146 views

reverse engineering hi3516ev200

I am new to reverse engineering and will describe my situation thus far. In short, I am looking for some tips on what to do next to gain access to a piece of hardware I am playing with. I bought a ...
0
votes
0answers
40 views

Capturing traffic of an integrated laptop keyboard

I'm trying to capture the traffic between my laptop's integrated keyboard and its controlling software on Windows. I'll analyze the traffic to write a driver for Linux to control keyboard backlight. I ...
1
vote
3answers
72 views

How to input ascii control character into program?

I am working on a CTF where I need to pass an address as input to a program. This address contains the value 0x09 (the tab character). This is causing me problems, because it seems that bash is ...
1
vote
1answer
285 views

`qemu-mips-static` chroot causing `Invalid ELF image` error

I'm trying to emulate a MIPS binary on my Ubuntu 16.04 x86 system, but I'm not able to. I chroot into the squashfs-root filesystem that I got from binwalking the firmware image. kan3k1@kaido:~/...
2
votes
0answers
73 views

submitting input into AFL fuzzer

I have some questions about the AFL Fuzzer: How does the AFL Fuzzer know where to inject the payload in the code I compile? For instance if I want to inject it in a specific parameter, how do I do it?...
2
votes
2answers
222 views

Prevent Memory Inspection in a Cython program?

Cython is a great way to protect the source code of a Python program. However, memory inspection and memory reverse engineering can still be done to this Cython program. What are ways to prevent (or ...
3
votes
1answer
139 views

IAT vs GOT address resolving: which of them resolve during runtime and which during load time by default?

So based on my knowledge on windows apps, as far as i know the IAT gets filled with correct addresses when the library gets loaded (correct me if I'm wrong) now in linux, they use GOT, and again ...
2
votes
1answer
116 views

Unknown archive format from QNX operating system

We are reverse engineering a QNX system and we have found a small file that is uploaded to the system. It appears to be either a file system image or an uncompressed archive of some sort. We can't ...
2
votes
1answer
252 views

Reverse getline(cin, text)

I'm trying to solve a crackme that was made in C++, and I was able to "recreate" a function call, through the library calls the program made. Here's the piece of code that I'm trying to reverse: ...
2
votes
0answers
503 views

Extracting firmware image from binary

I have firmware file in .bin format, but I need get firmware.img image file and Kernel uImage file for reflashing bricked device. How can I get these parts? I used Binwalk to extract content, ...
4
votes
1answer
355 views

Radare2 ptrace can not attach

First my setup: Linux Mint 64bit 4.15.0-20-generic radare2 the newest version from github /etc/sysctl.d/10-ptrace.conf = 0 Executable: ELF 64-bit LSB executable, x86-64 read write and ...

1
2 3 4 5 6