Questions tagged [linux]

A free and open source POSIX compatible operating system with a monolithic kernel and a kernel module system. Originally created by Linus Torvalds.

Filter by
Sorted by
Tagged with
0
votes
1answer
57 views

How can I debug open source C code for Linux?

I want to debug & reverse engineer open source code such as this project. I usually use CLion to write and debug C code on Linux. I've also used GDB. What steps do I need to take to download a ...
-2
votes
0answers
47 views

Interest in adapting signal processing for reverse engineering principally from a biogenomic standpoint [migrated]

NB: This was also posted over on dsp.stackexchange.com. I am seeking any possible help for a problem I have devoted a quite protracted period of time exploring. I am total perm disabled, and thus ...
1
vote
2answers
55 views

Repacking an embedded initramfs

I'd like to modify some of the init scripts in an initramfs that is embedded in a kernel bzImage. I know I can modify them by not changing the size of any files (e.g. by commenting out lines, and ...
0
votes
0answers
15 views

Endoscope Camera YPC99 - how to stream on linux

I'm trying to stream video from endoscope camera YPC99 on linux PC using the WiFi connection. From what I have found so far the camera is using IP 192.168.1.1. It supports RTSP protocol on port 7070 (...
0
votes
0answers
12 views

Open all object files in Ida

I have archive file , like libc.a . When I tried to open it with ida, ida ask to choose one object file that contain in archive file. Is there any way to open all the object files in one Ida project?...
0
votes
1answer
27 views

Find all syscall in statically Arm Binary

What is the easy and fast way to find all syscall in statically Arm binary ? Is there any Ida plugin that do that?
0
votes
0answers
35 views

What does the file pointer of fgets actually point to in linux?

So i was reversing a 64 bit ELF binary, and it did a call to fgets, and based on documentation the third argument of fgets is a file pointer. now the weird part was that the third argument in this ...
0
votes
1answer
33 views

Modern methods of fuzzing/locating heap bugs and potential vulnerabilites

really glad I found this great learning resource. I was wondering, is there any way to fuzz or automate heap vulnerability assesment? I know a lot of practical frameworks for stack based fuzzing in ...
0
votes
0answers
33 views

Find common functions in arm static binary

According to Detecting libc function with IDA I have static binary for arm and I want to find common function like fread sleep printf ioctl etc. When I looking for string in this binary I found glibc ...
1
vote
1answer
144 views

Sniffing TCP packets using Wireshark

I am trying to reverse engineer a decoder. The decoder contains a web server that makes sending/receiving information through the Internet possible. To do so I need to sniff the packets that the ...
0
votes
1answer
61 views

Protected shell in embedded linux

When I run telnetd -l /bin/sh on an embedded Linux device and use Putty to telnet to it, the provided shell is /bin/psh (protected shell). On this device, /bin/sh is a symbolic link to /bin/busybox. ...
0
votes
0answers
68 views

a.out: Invalid ELF image for this architecture

I am trying to run arm executable using qemu and I am getting this following error a.out: Invalid ELF image for this architecture. My assemble code hello.s .text .global _start _start: mov r0, #1 ...
9
votes
2answers
6k views

How does glibc malloc work?

Wishing to dig in the internals of dynamic memory allocation on Linux, the best I could find is an article titled Understanding glibc malloc. The explanation, though detailed, is not quite ...
2
votes
1answer
791 views

Is there a way to debug an elf file that runs with no problems with damaged header?

My question is general, but to have an example to work with, let us take one from Whirlwind Tutorial. ; tiny.asm BITS 32 org 0x00010000 db 0x7F, "ELF" ; ...
4
votes
1answer
471 views

How to do debug a running java process in linux?

TLDR I want to do live debugging of a java program on a linux machine, and don't how/what debugger to attach to the JVM to get this done. I expect that this is a well-solved problem, but I lack the ...
0
votes
0answers
43 views

Modifying a legacy uImage

I have an old device from which I extracted a uImage. I know it has a linux kernel and a cpio filesystem in the uImage, and I need to make some changes to the filesystem. I'm hoping someone can help ...
-1
votes
2answers
88 views

How to see assembly of main function?

How can I dump the assembly of main function of binary(not striped) in ubuntu? I want to see the assembly command and the hex value of this command There are 1 binary for arm and 1 binary for x86
1
vote
0answers
18 views

Format of Alcatel_Lucent I-240W-A backup file

I am trying to modify the backup file of this router in order to change some configurations. Here is the structure I have until now: 16 bytes of the header, zlib compressed xml with the ...
0
votes
0answers
37 views

Address of calling syscall

With strace I can see all syscall that process call. Is there any way to know witch address of process call to this syscall?
0
votes
0answers
42 views

Performing Buffer overflow in Linux

I have buffer overflow in a program i check(it is an array of pointers, and i can overflow the data in the first pointer), but the data i can write is not on the stack, it is on a space the system ...
1
vote
0answers
48 views

IDA shows MEMORY or unknown references on C std library calls (memset, memcpy, etc.)

I'm currently reversing a Linux 32-bit executable (with a statically linked library included in it) but I'm having a little problem I can't find a solution for. Basically whenever I stumble across a ...
1
vote
2answers
330 views

mprotect syscall not working

I want to modify the protection of the .text segment to RWX using a shellcode. In the shellcode, I can issue the syscall for mprotect however it's not working. Per the sys_mprotect definition, it ...
0
votes
1answer
28 views

Linux encryption/luks/pymouth password scripts corruption

I noticed that the bootup scripts that collect the password for full disk encryption on linux (fedora-31) were displaying corrupted text. The kind that looked like binary data being printed at text: ...
0
votes
1answer
146 views

Changing local variable in caller from callee in C?

I'm implementing a function which is going to perform some time-consuming task, and I'd like to hack the benchmarking part a bit by changing the variable indicating the CPU time my function has ...
1
vote
3answers
64 views

How to input ascii control character into program?

I am working on a CTF where I need to pass an address as input to a program. This address contains the value 0x09 (the tab character). This is causing me problems, because it seems that bash is ...
3
votes
0answers
58 views

The buffer is too short to insert addresses when exploiting buffer overflow

Newbie here. Sorry for what you about to read . I'm currently working on exploiting a binary on Ubuntu 18.04. Here is some information about the binary: Its checksec information using pwntools: ...
1
vote
3answers
2k views

How to extract content of NVRAM file?

How to extract content from NVRAM file? NVRAM type is SPI Serial NOR Flash. NVRAM has been copied as mtdblock partition. An embedded device that run Linux v2.6.18_pro500. Linux version 2.6.18_pro500 ...
2
votes
1answer
82 views

What is actually loaded here and different hexdump outputs on util-linux hexdump and on cutter and ghidra's hexdump

I was trying to understand what segment of file gets loaded by fourth LOAD header on phdr array. First 6 headers are shown below from readelf Program Headers: Type Offset ...
2
votes
1answer
116 views

ildasm on Linux: “original” ildasm.exe same as dotnet-ildasm?

I would like to use ildasm on Linux. The original one, that comes with the .NET SDK and can be found on Windows e.g. at c:\Program Files (x86)\Microsoft SDKs\Windows\v8.0A\bin\NETFX 4.0 Tools\. I ...
1
vote
0answers
79 views

Extract files of a SquashFS Filesystem

I already asked a similar question but after a deeper analysis of the filesystem I found out that I misunderstood the problem and that's why I decided to delete the old question and make a new one. I ...
0
votes
0answers
61 views

Why does this execve shellcode work with this argv?

I wrote the following program in fasm, and am using Evan's Debugger on Ubuntu to debug it: format ELF64 executable 3 segment readable executable entry $ mov rbp, rsp sub rsp, 32 mov rax, 'this a t' ...
1
vote
1answer
69 views

reverse engineering hi3516ev200

I am new to reverse engineering and will describe my situation thus far. In short, I am looking for some tips on what to do next to gain access to a piece of hardware I am playing with. I bought a ...
6
votes
1answer
366 views

Extracted router file execution

I am trying to run an executable file that I dug out from an extracted file system of a DSL modem router. So first of all I needed to either have a MIPS Linux box or take the emulation path. After ...
2
votes
2answers
155 views

Prevent Memory Inspection in a Cython program?

Cython is a great way to protect the source code of a Python program. However, memory inspection and memory reverse engineering can still be done to this Cython program. What are ways to prevent (or ...
0
votes
0answers
27 views

Capturing traffic of an integrated laptop keyboard

I'm trying to capture the traffic between my laptop's integrated keyboard and its controlling software on Windows. I'll analyze the traffic to write a driver for Linux to control keyboard backlight. I ...
4
votes
1answer
638 views

how to flash image.bin with uboot using serial or tftp

Hello I have a 4G LTE router which is blocked. and I have already dumped the partitions before via telnet from another device of the same model. U-Boot 2010.09 (Sep 06 2016 - 10:08:39)GCT GDM7243 ...
2
votes
2answers
2k views

How to locate module_init() offset from ELF header of Linux kernel module?

The header is self explanatory but to explain myself better. I have an ELF binary - loadable kernel module, compiled with symbols. I want to know how to locate the offset of the module_init() function....
1
vote
1answer
108 views

`qemu-mips-static` chroot causing `Invalid ELF image` error

I'm trying to emulate a MIPS binary on my Ubuntu 16.04 x86 system, but I'm not able to. I chroot into the squashfs-root filesystem that I got from binwalking the firmware image. kan3k1@kaido:~/...
2
votes
1answer
289 views

Mechanisms to stop serial console accepting input on a Linux system?

I am working on a simple embedded system based around an Olinuxino board. This has a serial console header onboard. TX and RX are both connected to the respective pins on the microcontroller (i.e. ...
2
votes
0answers
44 views

submitting input into AFL fuzzer

I have some questions about the AFL Fuzzer: How does the AFL Fuzzer know where to inject the payload in the code I compile? For instance if I want to inject it in a specific parameter, how do I do it?...
2
votes
1answer
322 views

Cannot open '/proc/…/maps': No such file or directory in radare2 debug mode

When I try to load a program to radare2 debug mode, most of the time I get the following error: $sudo r2 -d a.out Hello world!= attach 2851 2851 Cannot open '/proc/2851/maps': No such file or ...
2
votes
1answer
172 views

Reverse getline(cin, text)

I'm trying to solve a crackme that was made in C++, and I was able to "recreate" a function call, through the library calls the program made. Here's the piece of code that I'm trying to reverse: ...
6
votes
3answers
2k views

Debugging forked child in an anti-debug protected crackme

I am interested in the anti-debugging method implemented in the crackme called trace-p. A child process is forked, which communicates with the parent using int3 instructions. I would like to debug the ...
3
votes
1answer
71 views

IAT vs GOT address resolving: which of them resolve during runtime and which during load time by default?

So based on my knowledge on windows apps, as far as i know the IAT gets filled with correct addresses when the library gets loaded (correct me if I'm wrong) now in linux, they use GOT, and again ...
6
votes
3answers
5k views

unpack Clear spot .bin firmware update

I am trying to unpack a clear spot firmware update The firmware I am trying to reverse can be found on the download page of the vendor I have used the fwtools to unpack the firmware as described on ...
2
votes
1answer
96 views

Unknown archive format from QNX operating system

We are reverse engineering a QNX system and we have found a small file that is uploaded to the system. It appears to be either a file system image or an uncompressed archive of some sort. We can't ...
1
vote
2answers
1k views

Basic shellcode doesn't work when read from stdin

I am working on a basic shellcode that will spawn a shell after getting called in a 32-bit program. Here is the shellcode i'm using: xor %eax,%eax push %eax push $0x68732f2f push $...
2
votes
0answers
311 views

Extracting firmware image from binary

I have firmware file in .bin format, but I need get firmware.img image file and Kernel uImage file for reflashing bricked device. How can I get these parts? I used Binwalk to extract content, ...
4
votes
2answers
2k views

TP-Link encrypted backup file TX-VG1530

I have been trying to wrap my head round this stuff so bear with me. I have a Tp-Link TX-VG1530. From the gui you can download the config file however the file is encrypted, I include a portion of ...
4
votes
3answers
4k views

How to SUCCESSFULLY add a code section to an executable file in Linux?

I am in Linux, and I have seen this question a few times but never, nobody answered how to really make this work. I need to add a section to an already compiled binary. Lets say for a moment is an ...

1
2 3 4 5 6