Questions tagged [linux]

A free and open source POSIX compatible operating system with a monolithic kernel and a kernel module system. Originally created by Linus Torvalds.

Filter by
Sorted by
Tagged with
4
votes
2answers
1k views

Flashing firmware on an embedded device

Anyone want to help out a noob? (excuse my incorrect terminology/ knowledge) I am venturing into unknown territory. The only experience I have is rooting/flashing firmware on my phone and installing ...
0
votes
1answer
84 views

How is linux loaded into a closed platform that has been hacked?

Today I have a question which may be a little uncertain. How would you "port" the Linux OS to a new platform? For example; The nintendo 3ds or the PS4, are consoles which have been recently "hacked", ...
9
votes
1answer
18k views

Managing inputs for payload injection?

I am looking for a complete list of the ways to inject a payload in a vulnerable program in a Unix (Linux) context depending on the inputs opened by the program. I know that there are several tricks ...
1
vote
0answers
636 views

Reverse Engineering Wifi Chip-set Firmware [closed]

I have Sparrow Wireless Adapter which from Qualcomm originally Wilocity that supports Wifi over 60 GHz (802.11ad or WiGiG). I have the firmware files of the wireless chipset (wil6210.fw and wil6210....
2
votes
1answer
2k views

Help mounting jffs2 dumped from NAND flash.

Ok so have been trying to look some settings from a jffs2 partition I extracted from a nand dump I had done previously Here ----> https://forum.openwrt.org/viewtopic.php?id=67564 Steps I have ...
0
votes
1answer
116 views

Intel PIN and nm unable to capture binary symbols

I'm trying to generate a log of all identified symbols in a binary file. The application i'm trying to inspect is busybox. I've created a Pin Tool that successfully captures symbols (no demangling) ...
2
votes
0answers
955 views

open a non-standard compression .tar.lzma file extracted from firmware download

We are trying to examine a firmware download for a product we have running on our local network. Using the command binwalk -Me filename we generated a folder that contains the following content: ...
3
votes
2answers
1k views

Technicolor TG799vac Modem/Router Dumping The Nand Flash

Ok, so I have been trying to dump the contents of a Technicolor TG799vac. So far I have removed the flash chip and read out the chip using the DumpFlash.py utility and used binwalk to locate the ...
1
vote
2answers
781 views

Is it possible copy and save bootloader using CLI telnet commands?

I need get copy of original Bootloader from device running embedded Linux. Is it possible copy and save bootloader using CLI telnet commands? I have full access to CLI interface. Is there way copy ...
3
votes
2answers
882 views

Finding a place to inject shellcode

I am following the tutorial for ROP Primer, level0. The tutorial sets the memory at the beginning of [vdso] writeable and executable and copies the shellcode there. I do not know why, but it seems ...
-1
votes
0answers
572 views

Allwinner Camera Reversing: Compiling V4L [closed]

I've reverse engineered quite a bit of action cameras based on Allwinner's poorly documented chipset. It runs firmware closely related to H3, in fact I can compile a kernel that boots with no video ...
1
vote
1answer
277 views

Is it possible to rebuild an nexe file if I can read at arbitrary untrusted memory addresses?

Ok, I’m in a remote situation where I don’t have access to the remote filesystem but where I can run arbitrary python code (except I can’t fork processes and I don’t have access to ulimit and uname). ...
0
votes
2answers
2k views

Recognize the library functions of statically linked executable file in IDA Pro

Recently I worked on a Linux program which has all of its symbols stripped. Opening it with IDA resulted in none of its functions identified. Thus I tried to extract any usable information from the ...
0
votes
3answers
5k views

Limited BusyBox shell

I'm testing some embedded device, and there is lack of documentation. When I telnet to device, I get only limited shell. BusyBox v1.19.2 (built-in shell (ash) Enter 'help' for a list of built-in ...
2
votes
0answers
119 views

Trace replayer won't load binary debug information

So I'm debugging a linux application with what I believe DWARF debug information on x86-64 host. Everything is working fine and as expected - the source files are loaded immediately on function ...
2
votes
2answers
2k views

How to locate module_init() offset from ELF header of Linux kernel module?

The header is self explanatory but to explain myself better. I have an ELF binary - loadable kernel module, compiled with symbols. I want to know how to locate the offset of the module_init() function....
0
votes
1answer
2k views

Extract YAFFS filesystem from binary

Iv got firmware from vivax set-top box backed up on flash drive and I vould like to change splash screen on it. The firmware seem to be yaffs but I cant extract files in order to change something. :~...
2
votes
0answers
2k views

Knockoff CGA/EGA to vga firmware update [closed]

The problem with this, as I know from experience in dealing with this exact same issue is the firmware in the CGA/EGA/VGA converter board. There is an update that needs to be written to the converter ...
3
votes
1answer
262 views

Master of Orion and scanmem

I am looking to use scanmem to change in game credits in the new Master of Orion (2016). Steps I have taken: Install and run scanmem as root Track credits successfully using scanmem It ...
5
votes
3answers
6k views

Segmentation fault while pushing onto the stack

So I have been following some tutorials on assembly and the instructor compiles the following code: ;hello3.asm attempts to make the code position independent section .text global _start _start: ;...
5
votes
3answers
5k views

QEMU & router firmware

I'm trying to get the router firmware (binary) running on QEMU (if that is possible). All networking is set up fine because I've tested it using the debian_wheezy_mips_standard.qcow2 sudo qemu-...
-1
votes
2answers
1k views

Formatting output of objdump -sj .text filename.exe

I am hoping to get the contents of the .text section, of a Microsoft PE file using a linux command. When I use objdump -sj .text filename.exe the output consists of the offset, in hexadecimal ...
-1
votes
1answer
332 views

Error: Invalid PE header machine value with pedump

I would like to dump the .text section on MS Windows .exe PE files in Ubuntu 14.04.4. I install pedump, on my Ubuntu system using sudo apt-get install mono-utils When I tried running pedump code /...
7
votes
2answers
2k views

32-bit binary stack layout on a x64 Linux OS

Stack layout is well documented in many ways. Especially for x86 systems as there were numerous tutorials on how to exploit stack overflow on old 32-bit systems many years ago. So far we can know ...
1
vote
1answer
4k views

Unable to view stack and memory addresses in IDA Pro [duplicate]

I am debugging a 32-bit ELF executable using remote GDB debugging option of IDA Pro. However, I am unable to view the contents of stack in the stack view. Also, the stack pointer value is: 0xFFFFD328 ...
1
vote
1answer
320 views

What checksum algorithm is this network protocol using?

I've been working my way through an undocumented TCP-based protocol by monitoring traffic with tcpdump, Wireshark, and some Python packages (scapy, numpy) with good luck so far, but I've hit a wall ...
2
votes
2answers
3k views

Static analysis of Windows executable from a Linux platform

I am trying to do some static analysis on crackmes written for Windows on a Linux platform. I am using radare2. My problem is that most of the time I am unable to find the "real" code, for example the ...
6
votes
3answers
2k views

Debugging forked child in an anti-debug protected crackme

I am interested in the anti-debugging method implemented in the crackme called trace-p. A child process is forked, which communicates with the parent using int3 instructions. I would like to debug the ...
9
votes
3answers
13k views

ZTE encrypted backup config file

I was poking around in ZTE Speedport Entry 2i (CPE used mostly in Germany, Slovakia etc, probably custom made for Deutsche Telekom). It's possible to download backup of config from UI. I found out ...
6
votes
3answers
2k views

Reversing self-modifying code

I am learning reversing an I am studying a code, which modifies itself (actually it is a crackme). It contains statements like: movw $0xc031, 0x(%edx), where edx contains the address of a statement. ...
-1
votes
2answers
406 views

Stopping at the original entry point in a packed file

During manual unpacking, the first task is to find to original entry point. The program jumps there after the unpacking is done. I took the bin/ls file, and checked with readelf -h that the entry ...
6
votes
0answers
4k views

How to unpack manually an upx packed elf file

I am trying to learn to manually unpack an upx packed elf file. The examples I have found are for Windows, mostly with Ollydbg, and as I see the first step is to look for pushad and popad instructions....
-3
votes
1answer
80 views

Which environment are comfortable for RE ( Free tool ) [closed]

I'm a beginner in RE. So i don't know which environments are better for me ( Linux or Window , 32bit or 64bit ). Which free tools are the best for each OS . Ollydbg is for Windows 32bit right?
4
votes
0answers
299 views

Modern equivalent to rsymtab for reconstructing symbol table for statically linked / stripped binaries?

I'm working with a 32-bit ELF binary that (I believe) has been statically linked against a few different third-party libraries. It has also been stripped, so I don't have much to go on with respect to ...
1
vote
1answer
976 views

Memory segment in IDA - ARM kernel

I just loaded up an ARM kernel image into IDA. When I boot up the ARM kernel and inspect the kernel symbols, I can see the following :- / $ cat /proc/kallsyms | head -n 10 00000000 t __vectors_start ...
3
votes
1answer
908 views

using GDB and dealing with breakpoint detection

I am trying to solve a reverse engineering challenge using using gdb. I can run the program inside it but when I set a breakpoint at main then I get Program received signal SIGSEGV, Segmentation ...
4
votes
2answers
4k views

Reversing Hisense TV Firmware

I am looking for methods to get root on my Linux smart tv. Anyone have any ideas, in order to try extract the kernel config. Hisense is no help when asking for GPL source. I ran metasploit against it ...
-1
votes
1answer
7k views

How to decrypt data in binary file by XOR operator using a given key at specific offset? [closed]

I've a binary data files which are encrypted by a simple XOR cipher using a given key at offset +0x88 (which is 0x80 long), then the data (+0x108) is compressed by lzo1x. What would be the most ...
0
votes
0answers
72 views

dlmalloc free pointers

I was looking at the implementation of "free" in my current dlmalloc(both the source and the disassembly). However, I could not find the code section the inserts the FD and BK into free chunks. What ...
1
vote
2answers
189 views

Freebøx Internet box, how to access HDD , root?

This is a question rather for french stack users. I wonder how I can read my Freebox server HDD (actually it i flash memory), as root ? Or, at least, how I could see Terminal of the box ? (It is ...
0
votes
1answer
147 views

Finding “free” inside libc.so

I extracted the libc.so.6 from within a vulnerable image used for exploitation purposes. I open up the shared object in IDA and I look at the symbols inside the "Exports" tab. I find "free"; upon ...
5
votes
1answer
3k views

Capturing OS/hardware communication / reverse engineering drivers

My main question is how the open source community reverse engineers windows drivers (for say, video cards) to re-write them under linux. Links to resources are fine, I don't expect a tutorial on ...
3
votes
2answers
2k views

How to stop debugger right after the execution?

I'm using /bin/true as my sample binary (without available main method): $ lldb /bin/true (lldb) target create "/bin/true" Current executable set to '/bin/true' (x86_64). (lldb) break main invalid ...
1
vote
2answers
257 views

How to debug binary which doesn't have executable flags?

I'm trying to debug the binary which is not executable. As sample I'm using /bin/true with 644 permission: install -m 644 /bin/true . and I'm trying to run it as: $ lldb true (lldb) target create "...
1
vote
3answers
3k views

How does storing values in registers result in a functioning program? [closed]

I'm currently learning assembly, but I cannot seem to understand how storing values into registers and manipulating them results in a working program. I was wondering if you guys could provide a ...
1
vote
1answer
913 views

One shellcode works, one doesn't - an issue with exploiting a 64 bit linux binary

I'm working on exploiting a simple 64 bit linux binary. I got control of RIP by exploiting a buffer overflow and using a jmp rsp to get control of the progrm. However, I'm having trouble with the ...
0
votes
0answers
379 views

Intercepting syscall in a shared object (dynamically linked)

Ditto. Any technique that allows to intercept sys calls issued from a shared object file? At runtime, the shared object is dlopen'ed by main(). One candidate is to use static binary rewriting (e.g. ...
2
votes
2answers
501 views

Putting an application in between client and server

I'm attempting to reverse engineer (without dissecting the source code, as my understanding is that reverse engineering by analyzing input and output and building something from scratch that fits is ...
1
vote
3answers
702 views

Dump global datas to disk in assembly code

the experiment is on Linux, x86 32-bit. So suppose in my assembly program, I need to periodically (for instance every time after executing 100000 basic blocks) dump an array in .bss section from ...
1
vote
1answer
3k views

Can mprotect set the stack itself as executable?

I'm taking my first steps in memory exploitation in Linux. I'm following a tutorial for a practice VM($ uname -r -> 3.13.0-32-generic) The tutorial makes a call to mprotect to set a certain region ...