Questions tagged [linux]

A free and open source POSIX compatible operating system with a monolithic kernel and a kernel module system. Originally created by Linus Torvalds.

Filter by
Sorted by
Tagged with
-1
votes
1answer
884 views

Dynamic Analysis on ELF using IDA

On Linux, while generally reversing ELF files and dynamic analyzing (like step into, step over, break-point, inspecting registers value, memory etc) I use gdb or radare2 which provides dynamic ...
-2
votes
2answers
148 views

Looking for reverse engneer online course [duplicate]

I looking for online reverse engeneer course. Course that study ida,reverse and patch for windows/ linux. Working with ida and another tool. I like many videos lesons. Do you know one?
0
votes
2answers
2k views

Adding additional language to Linux based Firmware of Volkswagen Car Radio

I'm owning a CarPlay head unit from Volkswagen called RCD330 plus. It is possible to upgrade/downgrade to any available firmwares. For example here are two firmware versions: http://rcd330plus.com/rcd/...
1
vote
0answers
162 views

Unsquashfs fails partways with gzip error code -5

I have been trying to unsquash a system.sfs file in order to modify the directories. however, unsquashfs system.sfs returns the following output: Parallel unsquashfs: Using 8 processors 1 inodes (...
0
votes
1answer
758 views

Linux x64 Disassembly: single movzwl operand question

A quick question regarding a movzwl instruction which do not behave as I expected. here is the disassembled code: movzwl (%rax),%eax Before the instruction, rax is 0x7fffffffe410 and point to 0x5 ...
1
vote
1answer
902 views

Rebuilding firmware back to binary file

I used Binwalk to extract firmware files, extracted content include 2 folders and one binary file. squashfs-root _351C.extracted 351C Squashfs-root contains file system, '_351C.extracted' folder ...
2
votes
1answer
116 views

ARM system crashes after changing stack address

-- Edit with latest update on the problem, it is not solved yet :( -- While playing with an ARM embedded Linux system (Version 3.8.13), out of curiosity, I created a small "debug" kernel module. ...
7
votes
2answers
8k views

ARM64 syscalls table

I wonder if there some syscall table for Linux ARM64 architecture? I found syscall table for Linux ARM32 and many other architectures, but the problem still exists. Does anyone know where can I find ...
0
votes
1answer
299 views

x64 Linux reverse-engineering - understanding asm code and inject eax

In a rootme exercise, i'm trying to bypass the control impleted to protect a "read" function. You'll find enclosed the code i'm refering to. As you may understand, i can inject data (with limitations) ...
2
votes
1answer
2k views

Disassemblers resolving (ELF) section names

I'm working with linux executables and was just wondering how it is that section names are resolved to addresses upon disassembly of an ELF. For example take some random disassembly output from ...
0
votes
1answer
2k views

Unpacking firmware

I have a ROM dump firmware which must be reversed (as a task). Binwalk output: DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------------------------------------...
4
votes
2answers
3k views

TP-Link encrypted backup file TX-VG1530

I have been trying to wrap my head round this stuff so bear with me. I have a Tp-Link TX-VG1530. From the gui you can download the config file however the file is encrypted, I include a portion of ...
1
vote
0answers
947 views

My core dump's backtrace stops to a signal handler, what can I do?

I obtained an ELF core dump that was provoked by fuzzing a proprietary server. As I do not have access anymore to the machine that hosted this server, and the server is part of a tightly coupled set ...
1
vote
2answers
2k views

Basic shellcode doesn't work when read from stdin

I am working on a basic shellcode that will spawn a shell after getting called in a 32-bit program. Here is the shellcode i'm using: xor %eax,%eax push %eax push $0x68732f2f push $...
1
vote
1answer
77 views

Redirecting Program Output from /dev/*char_device* to Text File

I am currently trying to reverse an IoT machine running the 2.6 Linux Kernel on which I have root. On this machine, software writes to /dev/some_device to control what I believe to be are GPIO pins ...
6
votes
3answers
6k views

Help reversing end-of-life'd Logitech Link. How to get Flash Contents

See Update below. I got an email from Logitech that they are End of Lifing their Harmony Link product (see https://community.logitech.com/s/question/0D55A0000745EkCSAU/harmony-link-eos-or-eol). So I ...
17
votes
1answer
3k views

Debugging with radare2 using two terminals

I have been trying to figure this out for quite some time now, and would really need some help. Firstly, some intro: I am running the newest version of radare2 from Github on a 64bit Ubuntu 16.04 and ...
5
votes
1answer
667 views

Need help with a USB gaming mouse

I have a Chinese USB gaming mouse (04d9:a070) which has 4 color modes and 4 light levels. I know for a fact that this mouse is capable for showing at least 5 different color so it must be an RGB led (...
2
votes
1answer
1k views

How can I view the dynamic symbol table of a running process?

For any dynamic executable on Linux there is a dynamic linker that stores the current symbol bindings somewhere. So when a new library is loaded it knows whether to bind the symbol or not. For ...
0
votes
1answer
8k views

Reverse engineering a golang binary file

I compiled docker by myself with some modifications. I would like to perform some static analysis to the binary. Mostly to see which parts of the code take more memory, etc. It's on linux (elf). Any ...
1
vote
1answer
195 views

library issue when running mips binary in a chrooted environment

Background In my endeavor to RE my router, I'm trying to emulate a router's firmware inside a QEMU MIPS system. I have debian-mips installed to a virtual disk that runs just fine. Its a MIPS32 Big ...
1
vote
2answers
1k views

IDA Pro - Applying function signatures

I have three files: ELF executable, ELF dynamically linked library (.so), C headers file (.h) with function signatures and related structures for that library. #1 imports a number of functions from #...
3
votes
0answers
93 views

methods for identifying deliberately unmagiked filesystem

I am trying to restore a system from backups around some obnoxious copy protection. It is a Linux system from an vendor that does not appear to comply with the GPL and has overwritten the header of ...
10
votes
1answer
4k views

Reverse Engineering ZyXel C1100Z modem firmware

first time post so please bear with me. For days I have been trying to bypass a password my ISP has added to their remote CLI with no luck. I have a Zyxel C1100Z DSL modem that I've purchased from ...
-1
votes
1answer
312 views

Practicing what SHOULD be a simple crackme. Program calls strlen() but never returns

I'm trying out a crackme from the "LSE CTF" called "Blue Box" worth only 10 points. I've attempted this inside GDB and radare2... It is very simple, takes one argument and first checks to make sure ...
2
votes
1answer
2k views

IDA Pro debugging: follow child process

I'm reverse engineering a malware that creates a number of child processes and I'm trying to do dynamic analysis of the ELF binary with IDA Pro and IDA's Local Linux Debugger, but I can't get IDA to ...
2
votes
1answer
135 views

Determining an application's library call behaviour

I have a closed source Linux library libfoo that makes calls into another closed source library libbar for additional (mostly unneeded) features. However, I can't use libbar for ethical reasons, so I ...
1
vote
1answer
608 views

How to extract an unknown archive file? Currently Im trying to open *.pak (P5CK)

I have a console game called Timesplitters Future Perfect(iso file). I were able to extract and got bunch of files. *.pak being one type I would like to open and see. I opened up a hex editor and saw ...
1
vote
1answer
765 views

Why always get the message “Illegal Instruction (core dumped)”?

I tried to exploiting buffer overflow. In the exploit code I use the Aleph-One shellcode. "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b" "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\...
1
vote
0answers
235 views

X64 ASSEMBLY - Cannot run compiled and linked raw shellcode in Windows

After using metasploit's windows/x64/meterpreter/reverse_tcp shellcode on my windows 10 machine (with AVs turned off), I decided to try to create a hand-made polymorphic, null-free and custom-encoded ...
1
vote
1answer
99 views

Is it possible to restart over a program by calling an entry point function?

I was wondering if it was possible to restart a program (ignoring previously mapped files) with different argument by either calling main() or a glibc entry point function.
1
vote
1answer
158 views

Length requirement on IOLI crackme input

So I'm just starting to learn reverse engineering and binary exploitation and going through the RPI course where the first lab set is drawn from the IOLI crackmes available on Github. I could post all ...
3
votes
1answer
1k views

Is there a way to debug an elf file that runs with no problems with damaged header?

My question is general, but to have an example to work with, let us take one from Whirlwind Tutorial. ; tiny.asm BITS 32 org 0x00010000 db 0x7F, "ELF" ; ...
2
votes
2answers
3k views

Changing Entrypoint in ELF executable

I wrote some code that does the following: Searches for and finds an offset in a binary file to add code (looks for a sequence of 00s I can overwrite). Then, I change the entrypoint of the ELF to ...
1
vote
0answers
117 views

What is the name of this technique?

A while back, on a Linux system, I found a strange binary being executed at seemingly random times with some strange arguments, briefly appearing in ps. There was nothing to be found at the usual ...
1
vote
0answers
669 views

ZyXEL P-2812HNU-F1, replacing the U-Boot on the board

I want flash regular(non branded) firmware on ZyXEL P-2812HNU-F1 router, which have branded version of firmware (customized for local MSO provider). To do this, I should first replace the U-Boot image ...
9
votes
2answers
7k views

How does glibc malloc work?

Wishing to dig in the internals of dynamic memory allocation on Linux, the best I could find is an article titled Understanding glibc malloc. The explanation, though detailed, is not quite ...
4
votes
1answer
3k views

Why are symbols with local binding present in the symbol table of my ELF files?

I found out that there are symbols with binding=LOCAL and visibility=HIDDEN in the symbol table (.symtab) of ELF executables/libraries. What are they needed for? They are not involved in the ...
2
votes
1answer
3k views

How to decrypt the config.bin from ZTE ZXV10 H201L

I have this file from my router its backup of user config,I suppose its compresed with zlib and encrypted with AES. Utility which is resposible to compress it and encrypt it is called cspd. In side ...
5
votes
3answers
5k views

How to SUCCESSFULLY add a code section to an executable file in Linux?

I am in Linux, and I have seen this question a few times but never, nobody answered how to really make this work. I need to add a section to an already compiled binary. Lets say for a moment is an ...
5
votes
4answers
4k views

Identify compression of this ZTE ZXV10 H201L V2 backup config file

This config.bin file is from a ZTE router. I would like to decompress it but I did not identify the compression used in the file. Maybe someone can. 00000000 99 99 99 99 44 44 44 44 55 55 55 55 aa ...
1
vote
1answer
136 views

3 questions on Assembly - meaning of code, Decompilation in Linux, Higher level perspective,

Following the question here (3 questions on assembly - syntax, meaning, and equivalent in high level code (eg C++)), I would like to know for the same x86 code in AT&T syntax: xor $0x20, (%eax) ...
1
vote
3answers
3k views

How to extract content of NVRAM file?

How to extract content from NVRAM file? NVRAM type is SPI Serial NOR Flash. NVRAM has been copied as mtdblock partition. An embedded device that run Linux v2.6.18_pro500. Linux version 2.6.18_pro500 ...
2
votes
1answer
530 views

How to store files on a router's NAND without writing the whole firmware

I want to modify my ZyXEL P-2812HNU-F1 dsl router by storing some extra files in /etc. However, /etc is mounted as tmpfs so changes are lost on reboot. But there's probably a way around it ;) # cat /...
0
votes
1answer
323 views

My nopsled getting Segmentation fault (core dumped)

After overwrite the EIP register, I try breakpoint on the function strcpy() and then run the program after a breakpoint in the debugger. Then I check the ESP register : (gdb) i r esp esp ...
3
votes
1answer
3k views

Can't get buffer to overflow over function pointer

I cannot get this buffer overflow exploit to work for the life of me. The source code is here. It is from the book, Hacking the Art of Exploitation. The subject here is the below struct: struct user {...
0
votes
0answers
63 views

What memory security settings are needed to allow a basic buffer overflow on Fedora 25?

I'm having a rather difficult time determining what memory security settings need to be adjusted on a fresh install of Fedora 25 in order to perform basic buffer overflows in the C language. As a ...
2
votes
1answer
581 views

Writing own custome syscall/int 0x80 on x64 system

Is there a way to write my own syscall/int 0x80 without using them? So, normally it goes like setup registers ... syscall or int 0x80 and I am interested in doing this without syscall/int 0x80 ...
2
votes
0answers
362 views

Using __kernel_vsyscall on x64 linux machine [closed]

I am trying to use __kernel_vsyscall instead of syscall/int 80 on linux x64. I have read that it can be done on Intel chips (I have one), but i can't find how can one do it. I have x32 version: int ...
8
votes
2answers
19k views

How to reverse engineer a Linux executable to find the parameters? [closed]

So I am on a Linux box with an executable.Vague - I know. This is what happens when I try and run it with an argument/parameter: me@there:~$ ./theFile theOption -a ./theFile : option requires an ...