Questions tagged [linux]

A free and open source POSIX compatible operating system with a monolithic kernel and a kernel module system. Originally created by Linus Torvalds.

Filter by
Sorted by
Tagged with
3
votes
1answer
340 views

How to do debug a running java process in linux?

TLDR I want to do live debugging of a java program on a linux machine, and don't how/what debugger to attach to the JVM to get this done. I expect that this is a well-solved problem, but I lack the ...
0
votes
0answers
36 views

Modifying a legacy uImage

I have an old device from which I extracted a uImage. I know it has a linux kernel and a cpio filesystem in the uImage, and I need to make some changes to the filesystem. I'm hoping someone can help ...
0
votes
1answer
37 views

Protected shell in embedded linux

When I run telnetd -l /bin/sh on an embedded Linux device and use Putty to telnet to it, the provided shell is /bin/psh (protected shell). On this device, /bin/sh is a symbolic link to /bin/busybox. ...
-1
votes
2answers
76 views

How to see assembly of main function?

How can I dump the assembly of main function of binary(not striped) in ubuntu? I want to see the assembly command and the hex value of this command There are 1 binary for arm and 1 binary for x86
1
vote
0answers
17 views

Format of Alcatel_Lucent I-240W-A backup file

I am trying to modify the backup file of this router in order to change some configurations. Here is the structure I have until now: 16 bytes of the header, zlib compressed xml with the ...
0
votes
0answers
32 views

Address of calling syscall

With strace I can see all syscall that process call. Is there any way to know witch address of process call to this syscall?
0
votes
0answers
42 views

Performing Buffer overflow in Linux

I have buffer overflow in a program i check(it is an array of pointers, and i can overflow the data in the first pointer), but the data i can write is not on the stack, it is on a space the system ...
1
vote
0answers
44 views

IDA shows MEMORY or unknown references on C std library calls (memset, memcpy, etc.)

I'm currently reversing a Linux 32-bit executable (with a statically linked library included in it) but I'm having a little problem I can't find a solution for. Basically whenever I stumble across a ...
1
vote
2answers
305 views

mprotect syscall not working

I want to modify the protection of the .text segment to RWX using a shellcode. In the shellcode, I can issue the syscall for mprotect however it's not working. Per the sys_mprotect definition, it ...
0
votes
1answer
28 views

Linux encryption/luks/pymouth password scripts corruption

I noticed that the bootup scripts that collect the password for full disk encryption on linux (fedora-31) were displaying corrupted text. The kind that looked like binary data being printed at text: ...
0
votes
1answer
142 views

Changing local variable in caller from callee in C?

I'm implementing a function which is going to perform some time-consuming task, and I'd like to hack the benchmarking part a bit by changing the variable indicating the CPU time my function has ...
1
vote
3answers
55 views

How to input ascii control character into program?

I am working on a CTF where I need to pass an address as input to a program. This address contains the value 0x09 (the tab character). This is causing me problems, because it seems that bash is ...
3
votes
0answers
49 views

The buffer is too short to insert addresses when exploiting buffer overflow

Newbie here. Sorry for what you about to read . I'm currently working on exploiting a binary on Ubuntu 18.04. Here is some information about the binary: Its checksec information using pwntools: ...
1
vote
3answers
2k views

How to extract content of NVRAM file?

How to extract content from NVRAM file? NVRAM type is SPI Serial NOR Flash. NVRAM has been copied as mtdblock partition. An embedded device that run Linux v2.6.18_pro500. Linux version 2.6.18_pro500 ...
2
votes
1answer
72 views

What is actually loaded here and different hexdump outputs on util-linux hexdump and on cutter and ghidra's hexdump

I was trying to understand what segment of file gets loaded by fourth LOAD header on phdr array. First 6 headers are shown below from readelf Program Headers: Type Offset ...
2
votes
1answer
88 views

ildasm on Linux: “original” ildasm.exe same as dotnet-ildasm?

I would like to use ildasm on Linux. The original one, that comes with the .NET SDK and can be found on Windows e.g. at c:\Program Files (x86)\Microsoft SDKs\Windows\v8.0A\bin\NETFX 4.0 Tools\. I ...
1
vote
0answers
69 views

Extract files of a SquashFS Filesystem

I already asked a similar question but after a deeper analysis of the filesystem I found out that I misunderstood the problem and that's why I decided to delete the old question and make a new one. I ...
0
votes
0answers
60 views

Why does this execve shellcode work with this argv?

I wrote the following program in fasm, and am using Evan's Debugger on Ubuntu to debug it: format ELF64 executable 3 segment readable executable entry $ mov rbp, rsp sub rsp, 32 mov rax, 'this a t' ...
1
vote
1answer
49 views

reverse engineering hi3516ev200

I am new to reverse engineering and will describe my situation thus far. In short, I am looking for some tips on what to do next to gain access to a piece of hardware I am playing with. I bought a ...
6
votes
1answer
339 views

Extracted router file execution

I am trying to run an executable file that I dug out from an extracted file system of a DSL modem router. So first of all I needed to either have a MIPS Linux box or take the emulation path. After ...
2
votes
2answers
138 views

Prevent Memory Inspection in a Cython program?

Cython is a great way to protect the source code of a Python program. However, memory inspection and memory reverse engineering can still be done to this Cython program. What are ways to prevent (or ...
0
votes
0answers
26 views

Capturing traffic of an integrated laptop keyboard

I'm trying to capture the traffic between my laptop's integrated keyboard and its controlling software on Windows. I'll analyze the traffic to write a driver for Linux to control keyboard backlight. I ...
4
votes
1answer
537 views

how to flash image.bin with uboot using serial or tftp

Hello I have a 4G LTE router which is blocked. and I have already dumped the partitions before via telnet from another device of the same model. U-Boot 2010.09 (Sep 06 2016 - 10:08:39)GCT GDM7243 ...
2
votes
2answers
2k views

How to locate module_init() offset from ELF header of Linux kernel module?

The header is self explanatory but to explain myself better. I have an ELF binary - loadable kernel module, compiled with symbols. I want to know how to locate the offset of the module_init() function....
1
vote
1answer
54 views

`qemu-mips-static` chroot causing `Invalid ELF image` error

I'm trying to emulate a MIPS binary on my Ubuntu 16.04 x86 system, but I'm not able to. I chroot into the squashfs-root filesystem that I got from binwalking the firmware image. kan3k1@kaido:~/...
2
votes
1answer
285 views

Mechanisms to stop serial console accepting input on a Linux system?

I am working on a simple embedded system based around an Olinuxino board. This has a serial console header onboard. TX and RX are both connected to the respective pins on the microcontroller (i.e. ...
2
votes
0answers
36 views

submitting input into AFL fuzzer

I have some questions about the AFL Fuzzer: How does the AFL Fuzzer know where to inject the payload in the code I compile? For instance if I want to inject it in a specific parameter, how do I do it?...
2
votes
1answer
301 views

Cannot open '/proc/…/maps': No such file or directory in radare2 debug mode

When I try to load a program to radare2 debug mode, most of the time I get the following error: $sudo r2 -d a.out Hello world!= attach 2851 2851 Cannot open '/proc/2851/maps': No such file or ...
2
votes
1answer
140 views

Reverse getline(cin, text)

I'm trying to solve a crackme that was made in C++, and I was able to "recreate" a function call, through the library calls the program made. Here's the piece of code that I'm trying to reverse: ...
6
votes
3answers
2k views

Debugging forked child in an anti-debug protected crackme

I am interested in the anti-debugging method implemented in the crackme called trace-p. A child process is forked, which communicates with the parent using int3 instructions. I would like to debug the ...
3
votes
1answer
51 views

IAT vs GOT address resolving: which of them resolve during runtime and which during load time by default?

So based on my knowledge on windows apps, as far as i know the IAT gets filled with correct addresses when the library gets loaded (correct me if I'm wrong) now in linux, they use GOT, and again ...
6
votes
3answers
5k views

unpack Clear spot .bin firmware update

I am trying to unpack a clear spot firmware update The firmware I am trying to reverse can be found on the download page of the vendor I have used the fwtools to unpack the firmware as described on ...
2
votes
1answer
666 views

Is there a way to debug an elf file that runs with no problems with damaged header?

My question is general, but to have an example to work with, let us take one from Whirlwind Tutorial. ; tiny.asm BITS 32 org 0x00010000 db 0x7F, "ELF" ; ...
2
votes
1answer
83 views

Unknown archive format from QNX operating system

We are reverse engineering a QNX system and we have found a small file that is uploaded to the system. It appears to be either a file system image or an uncompressed archive of some sort. We can't ...
1
vote
2answers
1k views

Basic shellcode doesn't work when read from stdin

I am working on a basic shellcode that will spawn a shell after getting called in a 32-bit program. Here is the shellcode i'm using: xor %eax,%eax push %eax push $0x68732f2f push $...
2
votes
0answers
256 views

Extracting firmware image from binary

I have firmware file in .bin format, but I need get firmware.img image file and Kernel uImage file for reflashing bricked device. How can I get these parts? I used Binwalk to extract content, ...
4
votes
2answers
2k views

TP-Link encrypted backup file TX-VG1530

I have been trying to wrap my head round this stuff so bear with me. I have a Tp-Link TX-VG1530. From the gui you can download the config file however the file is encrypted, I include a portion of ...
4
votes
3answers
4k views

How to SUCCESSFULLY add a code section to an executable file in Linux?

I am in Linux, and I have seen this question a few times but never, nobody answered how to really make this work. I need to add a section to an already compiled binary. Lets say for a moment is an ...
5
votes
3answers
6k views

Packers/Protectors for Linux

I was wondering if anyone had come across a packer/protector which could be used for ELF binaries. There seem to be quite a few articles on writing packers and protectors for the PE format -- however, ...
4
votes
1answer
210 views

Radare2 ptrace can not attach

First my setup: Linux Mint 64bit 4.15.0-20-generic radare2 the newest version from github /etc/sysctl.d/10-ptrace.conf = 0 Executable: ELF 64-bit LSB executable, x86-64 read write and ...
0
votes
2answers
104 views

Unable to exploit format string vulenrability on Ubuntu 18.04.2 LTS

I am studying from "Hacking: The Art of Exploitation" and in program fmt_vuln.c format string is exploited. I am getting Segmentation Fault error. Checking position of AAAA on stack: $ ./fmt_vuln ...
0
votes
0answers
46 views

Bufferoverflow Stack

I want to do a buffer overflow exploit in the stack. For this i read in data via the "gets"-function. void ExploitMe() { char buffer[256]; gets(buffer); } I compile this file with gcc test.c -...
4
votes
3answers
5k views

RE Compressed backup file,router linux based so is it compresed with zlib?

so I have backup from my router its zte zxv10h201l and its linux based but I can not identify type of compression of this file. Here is couple of first "lines" of it 00000000 99 99 99 99 44 44 44 ...
1
vote
1answer
125 views

Why have two symbols tables?

Why have two symbol tables if .symtab already contains everything that's in .dynsym ?
5
votes
3answers
900 views

Linux protectors: any good one out there?

I know no one that works as of today (i.e., kernels not way too old) and I wonder if anybody found or knows any protector for Linux either commercial, open source, used in malware, etc...
4
votes
2answers
387 views

Can i trap SIGSEGV (on a linux) and what are are the conditions to make it works ? (for a crackme)

Friendly greetings ! I'm writing some crackmes.one challenge and i want to write a challenge where the solution appears on a segmentation fault. (And you have to disassemble the code to find a way ...
2
votes
2answers
361 views

How can I pass input to my program while debugging it with IDA

I have a program that waits for the user to enter a string input, how can I enter that string input while debugging my program with IDA?
1
vote
1answer
189 views

Unexpected SEGFAULT when there's apparently nothing that would cause it

This is a from a CTF problem I'm working on. Hopefully it's appropriate to ask this question here. Above is the GDB output when the segfault goes off. movaps is the offending instruction, meaning ...
0
votes
1answer
112 views

Understand what Ioctl do

I looking in ida on arm linux binary . I can see there that there is ioctl call ioctl(fd,req,num). fd is fd to /dev/module. ,req is some 4bytes and num is some number. How can I understand what ...
1
vote
1answer
305 views

Changing entry-point of and ELF file

I'm trying to conduct a little experiment which basically consists of changing the EP of an ELF file and executing an exit(9) syscall, without returning to the OEP. As shown in the image everything ...

1 2 3 4 5 6