Questions tagged [linux]

A free and open source POSIX compatible operating system with a monolithic kernel and a kernel module system. Originally created by Linus Torvalds.

Filter by
Sorted by
Tagged with
2
votes
0answers
167 views

How can one debug a program that can only be started by other processes?

I am now trying to figure out the innards of a custom made program that I've found difficult to debug using a debugger. The program starts by using a bash script wrapper to process input parameters, ...
3
votes
1answer
3k views

How to rebase IDA to match GDB

I would like to debug my elf file on linux using GDB and follow the disassembly in IDA, is this possible? And if it is how would I rebase IDA to match with GDB? Thanks!
2
votes
1answer
394 views

possible to rebase an ELF file?

Is there any way to rebase an ELF file? (i want to load an elf binary at 0x40000000, not at 0x08040000 which is typical base) I found this tool(prelink, http://en.wikipedia.org/wiki/Prelink), but it'...
1
vote
1answer
829 views

How to debug a binary with the relative path in argv[0]?

I have a binary test that I want to debug with gdb. As you can see pwd is /tmp: $ gdb (gdb) file test Reading symbols from /tmp/test...(no debugging symbols found)...done. (gdb) pwd Working directory ...
1
vote
2answers
946 views

Modifying / Installing stock firmware on ISP Branded WRE2205

Our ISP, MWeb, gave us a free router and Wifi extender (WRE2205v2) as part of a new promotion. Neither of them really work at all (the extender works for about a minute then fails for no apparent ...
7
votes
2answers
11k views

Why does `ldd` and `(gdb) info sharedlibrary` show a different library base address?

I see three different outputs for where libc should be loaded. ldd shows the loading address of libc at 0xf7e9e000 $ ldd ~/my_tool linux-gate.so.1 => (0xf7ffe000) libc.so.6 => /lib/...
3
votes
1answer
2k views

ELF link_map when linked as RELRO

When linking a binary with -Wl,-z,relro,-z,now, all relocations are performed at start-up before passing control to the binary. Because of this, there is no need for the .got.plt segment. Normally, ...
44
votes
8answers
28k views

How do I add functionality to an existing binary executable?

I want to add some functionality to an existing binary file. The binary file was created using gcc. Do I need to decompile the binary first, even though I sufficiently understand the functioning of ...
1
vote
0answers
317 views

Why the extracted content differs?

I used binwalk to extract firmware.bin image, the extracted content is squashfs-root dir, and a separate dpc.squashfs file. Then I used sasquatch utility to extract content of dpc.squashfs file, and I ...
1
vote
1answer
239 views

How do I restore modified firmware to a read only mount

I have managed to get a root shell on my web filtering router by plugging into a UART on the PCB which allowed me to see a process (lockbox.bin - ELF executable) running which handles most of the ...
2
votes
2answers
579 views

Find sigtrap function

I'm reversing a program that uses a lot of BREAK/int 3 (Linux). I guess that the code contains something like: void sigtrap_func(int sig) { (some stuff..) } int main() { signal(SIGTRAP, ...
2
votes
1answer
422 views

File Type - VCDIFF binary extract

I have a file I am trying to extract to view and I'm stuck... If I use binwalk I am able to get the gunzip file but unable to extract it... If I attempt to extract with gunzip I return the errors and ...
1
vote
1answer
743 views

In-circuit programming of SPI Flash memory

Is it possible to define (using only visual inspection of PCB and multimeter) whether or not SPI Flash memory can be properly programmed keeping the device In-circuit, without desoldering IC from the ...
2
votes
0answers
560 views

Flashing NVRAM with U-Boot 1.2.0

I tried to program SPI Flash NVRAM (S25FL064A) from U-boot, but it not allow to write: tftp 0x80000100 nvram.bin cp.b 0x80000100 0x007b0000 0x00050000 There is no error shown after cp.b command, ...
1
vote
1answer
1k views

Erase the data from the NVRAM

Cable modem SPI Flash memory have the following structure: 7 cmdlinepart partitions found on MTD device spansion partitions[0] = {.name = U-Boot, .offset = 0x00000000,.size = 0x00020000 (128K) } ...
0
votes
0answers
117 views

Set up an interrupt handler at kernel mode

I'm looking for something (a tool?) that can help me achieve my current goal: write a driver that can momentously interrupt the execution of the operating system (Linux, in my case), let me be able to ...
8
votes
1answer
766 views

Understanding segment prefixes in assembly for Linux

In looking at some assembly, I have come across a few instructions using segment prefixes. For example <address>: .... mov eax,DWORD PTR gs:0x20 I understand the basics of memory segments, ...
9
votes
3answers
2k views

Did somebody start to reverse engineer the proprietary Linux Brother Cups drivers?

I'm not very experienced with graphic or printer formats. My first (and only try yet) was to print a Tux.png with 265 x 314 pixel via the Chromium browser and see what Wireshark shows as USB transfer. ...
0
votes
4answers
4k views

Can IDA Pro on Linux disassemble a Windows PE (or Mac OS X app)?

I am thinking of buying IDA Pro for my Linux programming environment after reverse engineering a bit with OllyDBG (under WINE)... But before I endorse into such a costly purchase I ask the following ...
1
vote
1answer
711 views

Kernel dealing with the section headers in an ELF

I recently read that the kernel and the dynamic loader mostly deal with the program header tables in an ELF file and that assemblers, compilers and linkers deal with the section header tables. The ...
2
votes
1answer
245 views

How can I figure where my router stores it's configuration across reboots?

I'm currently researching my home router (D-Link 2760-U) which has a (kind-of) proprietary ISP firmware. What I'm trying to achieve is understanding how the router is persisting it's configuration ...
1
vote
1answer
1k views

ldd showing absolute path only

Under what circumstances does the output of ldd have only the absolute path? In the below eg, /usr/lib/arm-linux-gnueabihf/libcofi_rpi.so and /lib/ld-linux-armhf.so.3. pi@raspberrypi ~ $ uname -a ...
7
votes
1answer
728 views

Why are values passed through useless copies?

So, say that I have the following code, which gives three examples of what I believe to be unnecessary copies of values. mov QWORD PTR [rbp-0x18],rdi mov rdx,QWORD PTR [rbp-0x18] lea rax,[...
2
votes
1answer
553 views

Are there ANY supported Fermi Disassemblers out there?

I've recently started exploring the world of GPU-based malware. Academia doesn't have a ton of papers here, but there's some powerful ones. I'm looking at trying to improve the communities tools in ...
3
votes
3answers
452 views

Need to extend the list of libraries that a shared (.so) library uses

I have a number of shared libraries calling each other (.so, ARM, Android), binary-only. I want to add logging to some functions, funcA(), ..., funcZ() defined in libsomething.so. The functions are ...
2
votes
1answer
2k views

gdb setting fs register on Linux

I'm debugging an ELF 64-bit binary using gdb and I notice that the %fs register is set to 0x63. For some testing that I'd like to perform I'd like to set the %fs register to 0x00. I tried doing a set ...
10
votes
4answers
3k views

How can I get a running thread's start address on linux?

Problem Statement I'm trying to get the address of a running thread's start_routine as passed in the pthread_create() call. Research so far It is apparently not in /proc/[tid]/stat or /proc/[tid]/...
3
votes
1answer
187 views

Calculating the page address a buffer belongs to

I was trying out a ROP exploit -- I'm trying to make an mprotect system call using ROP(not a libc call), to try and make the buffer executable. I tried stracing the server process and ran the exploit, ...
1
vote
2answers
876 views

Replace strings in object file

I have an object file under Linux with a lot of strings in it. I would like to replace all strings that represent a specific path in this object. I can see all the strings I need to change using the ...
3
votes
3answers
1k views

Good Public Practice Binaries? [closed]

I'm looking for some good x86 linux binaries that cover most general vulnerabilities you would find while reversing. Does anyone have any good references to binaries that are public and available for ...
1
vote
1answer
198 views

Binary file search tools [closed]

Is there a open-source Linux tool / utility for Linux platform that would recursively search for binary files (executable, shared / static objects, etc), in a folder and display?
3
votes
0answers
299 views

I want to know more about how a particular exploit works. How do I do that? [closed]

I am given a VM of a server running a vulnerable version of ProFTP and a attacker VM which exploits the server using an exploit provided with MetaSploit. I need to write a Snort rule to detect ...
6
votes
0answers
306 views

Hauppauge HVR-950Q - Linux - Signal Processing for extra data like subtitles [closed]

I have a Hauppauge HVR-950Q running on a stripped down debian. I am trying to use the Hauppauge HVR-950Q from the command line to parse subtitles and build a library of accurate subtitles. I am not ...
4
votes
2answers
2k views

IDA Pro converting to instruction functionality: how to automate.

I am loading various files that read into IDA as binary. Once I have the GUI in front of me I am able to go through the segments and hit "c" in order to convert to instruction/code. However, I am ...
4
votes
1answer
2k views

Merging elf shared-objects

Let say I have libA.so and libB.so, is there any way for me to combine them into a single shared library libC.so that contains all exported symbols of both libA.so and libB.so?
4
votes
1answer
558 views

Changing parameter of function call in ELF executable

I want to alter a ELF executable function call and replace one of it's parameters. The executable calls dlopen() function and passes RTLD_NOW as the flag parameter. I want to change it to RTLD_LAZY. ...
8
votes
2answers
2k views

Attaching GDB to a specific fork

I am trying to reverse engineer a Linux binary that makes several fork() calls. I am using GDB 7.5 on Ubuntu. What I am trying to do with GDB is attach to a certain fork() (say the second call). Is ...
1
vote
0answers
294 views

Where can i find unix/linux tool for fuzzing for kill-switches? [closed]

I'm looking for linux/unix open-source tools for fuzzing ethernet card for kill-switch packets. https://en.wikipedia.org/wiki/Fuzzing I can imagine how it would be long to brute full of range on ...
20
votes
2answers
10k views

How to reverse engineer simple usb device [windows -> linux]

I'd like to reverse engineer my usb beer-can refrigurator, which does connect via USB on windows and via simple GUI tray-tool can set/query temperature. I was thinking about running virtualboxed ...
32
votes
5answers
8k views

How can I analyse an executable with no read permission?

I have a binary on a Linux (Kernel 2.6) which I can execute, but can't read (chmod 0711). Therefore no static analysis is possible. user1: $ ls -l bin -r-s--x--- user2 user1 bin user1: $ file bin ...
6
votes
1answer
391 views

How can I check I've moved outside the stack without triggering a protection fault?

I'm adding a feature to my Linux debugger (I'm using Ptrace to manipulate the traced process as well as libbfd/libopcodes) to unwind the stack and determine if discrepancies exist between each CALL's ...
9
votes
3answers
4k views

Why does the function pointer get overwritten even though is declared before the vulnerable buffer?

I am working on io-wargames for fun right now, level3: I do understand why there is a stack-overflow in this code (strlen(argv[1])), but what I don't understand is why it overflows the function ...
10
votes
3answers
3k views

Hooking functions in Linux and/or OSX?

I want to hook functions in a library (lib.so or lib.dylib) from another process. I know that unlike windows libraries, libraries in linux and mac still have their symbols (function names and ...
11
votes
1answer
4k views

How are stripped shared libraries linked against?

Lately I've been reversing the Android framework for the Nexus S mobile phone. 99% of the source code is of course open, but there are few propriety shared libraries which needs to be downloaded in ...
7
votes
2answers
5k views

Base address of shared objects from ldd output

I'm on a Linux machine with ASLR disabled. Running ldd on a binary gives me the following result : linux-gate.so.1 => (0xb7fe1000) libc.so.6 => /lib/i386-linux-gnu/libc.so.6 (0xb7e5c000) /lib/...
94
votes
1answer
69k views

How to handle stripped binaries with GDB? No source, no symbols and GDB only shows addresses?

I have GDB but the binary I want reverse engineer dynamically has no symbols, that is when I run the file utility it shows me stripped: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), ...
12
votes
3answers
9k views

Locating Linux Kernel Symbols on ARM

Igor posted a great answer previously on SO about the format of the Linux kernel image on ARM. Assuming I can't boot my kernel image, can someone give me pointers on finding this compressed symbol ...
7
votes
4answers
10k views

How to check if an ELF file is UPX packed?

I have an ELF file and want to know if it is UPX packed. How can I detect UPX compression in GNU/Linux?
6
votes
2answers
275 views

How should I go about trying to figure out the programming language that was used?

I have an executable file and I would like to figure out which programming language was the source code written in. The first step would be to use a disassembler. What should be done after that ? ...
-8
votes
1answer
1k views

How can I turn .deb files back to .tar for reuse with other Linux distros? [closed]

We all know that Ubuntu is the most popular Linux distro today with plenty of application currently being developed for it. But then I use Fedora and some use other distros but still liked to have the ...