Questions tagged [linux]

A free and open source POSIX compatible operating system with a monolithic kernel and a kernel module system. Originally created by Linus Torvalds.

Filter by
Sorted by
Tagged with
2
votes
2answers
459 views

Putting an application in between client and server

I'm attempting to reverse engineer (without dissecting the source code, as my understanding is that reverse engineering by analyzing input and output and building something from scratch that fits is ...
0
votes
3answers
4k views

Limited BusyBox shell

I'm testing some embedded device, and there is lack of documentation. When I telnet to device, I get only limited shell. BusyBox v1.19.2 (built-in shell (ash) Enter 'help' for a list of built-in ...
1
vote
0answers
116 views

What is the name of this technique?

A while back, on a Linux system, I found a strange binary being executed at seemingly random times with some strange arguments, briefly appearing in ps. There was nothing to be found at the usual ...
1
vote
0answers
637 views

ZyXEL P-2812HNU-F1, replacing the U-Boot on the board

I want flash regular(non branded) firmware on ZyXEL P-2812HNU-F1 router, which have branded version of firmware (customized for local MSO provider). To do this, I should first replace the U-Boot image ...
5
votes
3answers
5k views

QEMU & router firmware

I'm trying to get the router firmware (binary) running on QEMU (if that is possible). All networking is set up fine because I've tested it using the debian_wheezy_mips_standard.qcow2 sudo qemu-...
6
votes
4answers
113k views

Converting assembly code to c

I have the following assembly code over Linux distro: # using the .data section for write permission # instead of .text section .section .data .globl _start _start: # displaying some characters ...
8
votes
3answers
6k views

How can I generate a call graph from an unstripped x86 Linux ELF?

There's a piece of software, for which I only have the binary, not the source code. It's: unobfuscated (so, not polymorphic or anything. It is optimized a bit, though) unstripped x86 32 bit ...
4
votes
1answer
3k views

Why are symbols with local binding present in the symbol table of my ELF files?

I found out that there are symbols with binding=LOCAL and visibility=HIDDEN in the symbol table (.symtab) of ELF executables/libraries. What are they needed for? They are not involved in the ...
2
votes
0answers
2k views

How to decrypt the config.bin from ZTE ZXV10 H201L

I have this file from my router its backup of user config,I suppose its compresed with zlib and encrypted with AES. Utility which is resposible to compress it and encrypt it is called cspd. In side ...
1
vote
1answer
129 views

3 questions on Assembly - meaning of code, Decompilation in Linux, Higher level perspective,

Following the question here (3 questions on assembly - syntax, meaning, and equivalent in high level code (eg C++)), I would like to know for the same x86 code in AT&T syntax: xor $0x20, (%eax) ...
2
votes
1answer
452 views

How to store files on a router's NAND without writing the whole firmware

I want to modify my ZyXEL P-2812HNU-F1 dsl router by storing some extra files in /etc. However, /etc is mounted as tmpfs so changes are lost on reboot. But there's probably a way around it ;) # cat /...
3
votes
1answer
3k views

Can't get buffer to overflow over function pointer

I cannot get this buffer overflow exploit to work for the life of me. The source code is here. It is from the book, Hacking the Art of Exploitation. The subject here is the below struct: struct user {...
0
votes
0answers
61 views

What memory security settings are needed to allow a basic buffer overflow on Fedora 25?

I'm having a rather difficult time determining what memory security settings need to be adjusted on a fresh install of Fedora 25 in order to perform basic buffer overflows in the C language. As a ...
2
votes
1answer
553 views

Writing own custome syscall/int 0x80 on x64 system

Is there a way to write my own syscall/int 0x80 without using them? So, normally it goes like setup registers ... syscall or int 0x80 and I am interested in doing this without syscall/int 0x80 ...
2
votes
0answers
350 views

Using __kernel_vsyscall on x64 linux machine [closed]

I am trying to use __kernel_vsyscall instead of syscall/int 80 on linux x64. I have read that it can be done on Intel chips (I have one), but i can't find how can one do it. I have x32 version: int ...
0
votes
1answer
83 views

How is linux loaded into a closed platform that has been hacked?

Today I have a question which may be a little uncertain. How would you "port" the Linux OS to a new platform? For example; The nintendo 3ds or the PS4, are consoles which have been recently "hacked", ...
1
vote
0answers
603 views

Reverse Engineering Wifi Chip-set Firmware [closed]

I have Sparrow Wireless Adapter which from Qualcomm originally Wilocity that supports Wifi over 60 GHz (802.11ad or WiGiG). I have the firmware files of the wireless chipset (wil6210.fw and wil6210....
11
votes
1answer
5k views

Understanding the most recent heap implementation under Linux

A few days ago, I was wondering how one could teach himself heap-based overflow exploitation. So I searched through documentation, subsequently practicing what I read in order to have a better ...
6
votes
0answers
4k views

How to unpack manually an upx packed elf file

I am trying to learn to manually unpack an upx packed elf file. The examples I have found are for Windows, mostly with Ollydbg, and as I see the first step is to look for pushad and popad instructions....
0
votes
1answer
115 views

Intel PIN and nm unable to capture binary symbols

I'm trying to generate a log of all identified symbols in a binary file. The application i'm trying to inspect is busybox. I've created a Pin Tool that successfully captures symbols (no demangling) ...
2
votes
0answers
847 views

open a non-standard compression .tar.lzma file extracted from firmware download

We are trying to examine a firmware download for a product we have running on our local network. Using the command binwalk -Me filename we generated a folder that contains the following content: ...
3
votes
2answers
1k views

Technicolor TG799vac Modem/Router Dumping The Nand Flash

Ok, so I have been trying to dump the contents of a Technicolor TG799vac. So far I have removed the flash chip and read out the chip using the DumpFlash.py utility and used binwalk to locate the ...
1
vote
2answers
687 views

Is it possible copy and save bootloader using CLI telnet commands?

I need get copy of original Bootloader from device running embedded Linux. Is it possible copy and save bootloader using CLI telnet commands? I have full access to CLI interface. Is there way copy ...
-1
votes
0answers
528 views

Allwinner Camera Reversing: Compiling V4L [closed]

I've reverse engineered quite a bit of action cameras based on Allwinner's poorly documented chipset. It runs firmware closely related to H3, in fact I can compile a kernel that boots with no video ...
1
vote
1answer
253 views

Is it possible to rebuild an nexe file if I can read at arbitrary untrusted memory addresses?

Ok, I’m in a remote situation where I don’t have access to the remote filesystem but where I can run arbitrary python code (except I can’t fork processes and I don’t have access to ulimit and uname). ...
3
votes
1answer
793 views

How to determine which thread implementation binary compiled with

Is it possible to determine if a binary (static or shared and not stripped) is compiled with Linuxthreads or NPTL implementation ?
2
votes
0answers
114 views

Trace replayer won't load binary debug information

So I'm debugging a linux application with what I believe DWARF debug information on x86-64 host. Everything is working fine and as expected - the source files are loaded immediately on function ...
3
votes
2answers
2k views

Determine Hash Method - Busybox Linux

I'm trying to figure out how an ARM-Based device running Busybox Linux is storing hashes for users in a configuration file. Basically, the system allows you to backup the entire configuration to a ...
3
votes
1answer
249 views

Master of Orion and scanmem

I am looking to use scanmem to change in game credits in the new Master of Orion (2016). Steps I have taken: Install and run scanmem as root Track credits successfully using scanmem It ...
0
votes
1answer
1k views

Extract YAFFS filesystem from binary

Iv got firmware from vivax set-top box backed up on flash drive and I vould like to change splash screen on it. The firmware seem to be yaffs but I cant extract files in order to change something. :~...
5
votes
3answers
5k views

Segmentation fault while pushing onto the stack

So I have been following some tutorials on assembly and the instructor compiles the following code: ;hello3.asm attempts to make the code position independent section .text global _start _start: ;...
4
votes
2answers
4k views

Reversing Hisense TV Firmware

I am looking for methods to get root on my Linux smart tv. Anyone have any ideas, in order to try extract the kernel config. Hisense is no help when asking for GPL source. I ran metasploit against it ...
2
votes
2answers
1k views

USB programmer for SPANSION S25FL064P flash memory

Can someone recommend a handy inexpensive USB programmer for SPANSION S25FL064P flash memory?
-1
votes
2answers
819 views

Formatting output of objdump -sj .text filename.exe

I am hoping to get the contents of the .text section, of a Microsoft PE file using a linux command. When I use objdump -sj .text filename.exe the output consists of the offset, in hexadecimal ...
-1
votes
1answer
297 views

Error: Invalid PE header machine value with pedump

I would like to dump the .text section on MS Windows .exe PE files in Ubuntu 14.04.4. I install pedump, on my Ubuntu system using sudo apt-get install mono-utils When I tried running pedump code /...
7
votes
2answers
2k views

32-bit binary stack layout on a x64 Linux OS

Stack layout is well documented in many ways. Especially for x86 systems as there were numerous tutorials on how to exploit stack overflow on old 32-bit systems many years ago. So far we can know ...
1
vote
1answer
290 views

What checksum algorithm is this network protocol using?

I've been working my way through an undocumented TCP-based protocol by monitoring traffic with tcpdump, Wireshark, and some Python packages (scapy, numpy) with good luck so far, but I've hit a wall ...
-1
votes
2answers
355 views

Stopping at the original entry point in a packed file

During manual unpacking, the first task is to find to original entry point. The program jumps there after the unpacking is done. I took the bin/ls file, and checked with readelf -h that the entry ...
2
votes
2answers
2k views

Static analysis of Windows executable from a Linux platform

I am trying to do some static analysis on crackmes written for Windows on a Linux platform. I am using radare2. My problem is that most of the time I am unable to find the "real" code, for example the ...
6
votes
3answers
1k views

Reversing self-modifying code

I am learning reversing an I am studying a code, which modifies itself (actually it is a crackme). It contains statements like: movw $0xc031, 0x(%edx), where edx contains the address of a statement. ...
-3
votes
1answer
78 views

Which environment are comfortable for RE ( Free tool ) [closed]

I'm a beginner in RE. So i don't know which environments are better for me ( Linux or Window , 32bit or 64bit ). Which free tools are the best for each OS . Ollydbg is for Windows 32bit right?
2
votes
0answers
272 views

Modern equivalent to rsymtab for reconstructing symbol table for statically linked / stripped binaries?

I'm working with a 32-bit ELF binary that (I believe) has been statically linked against a few different third-party libraries. It has also been stripped, so I don't have much to go on with respect to ...
1
vote
1answer
887 views

Memory segment in IDA - ARM kernel

I just loaded up an ARM kernel image into IDA. When I boot up the ARM kernel and inspect the kernel symbols, I can see the following :- / $ cat /proc/kallsyms | head -n 10 00000000 t __vectors_start ...
4
votes
1answer
3k views

Illegal Instruction on sample Buffer Overflow exploit

I have followed the example here. Here is my sample program, "oldskool.c": #include <string.h> void go(char *data) { char name[64]; strcpy(name, data); } int main (int argc, char **...
-1
votes
1answer
6k views

How to decrypt data in binary file by XOR operator using a given key at specific offset? [closed]

I've a binary data files which are encrypted by a simple XOR cipher using a given key at offset +0x88 (which is 0x80 long), then the data (+0x108) is compressed by lzo1x. What would be the most ...
0
votes
0answers
72 views

dlmalloc free pointers

I was looking at the implementation of "free" in my current dlmalloc(both the source and the disassembly). However, I could not find the code section the inserts the FD and BK into free chunks. What ...
0
votes
1answer
133 views

Finding “free” inside libc.so

I extracted the libc.so.6 from within a vulnerable image used for exploitation purposes. I open up the shared object in IDA and I look at the symbols inside the "Exports" tab. I find "free"; upon ...
1
vote
2answers
185 views

Freebøx Internet box, how to access HDD , root?

This is a question rather for french stack users. I wonder how I can read my Freebox server HDD (actually it i flash memory), as root ? Or, at least, how I could see Terminal of the box ? (It is ...
5
votes
1answer
3k views

Capturing OS/hardware communication / reverse engineering drivers

My main question is how the open source community reverse engineers windows drivers (for say, video cards) to re-write them under linux. Links to resources are fine, I don't expect a tutorial on ...
1
vote
2answers
231 views

How to debug binary which doesn't have executable flags?

I'm trying to debug the binary which is not executable. As sample I'm using /bin/true with 644 permission: install -m 644 /bin/true . and I'm trying to run it as: $ lldb true (lldb) target create "...