Questions tagged [linux]

A free and open source POSIX compatible operating system with a monolithic kernel and a kernel module system. Originally created by Linus Torvalds.

Filter by
Sorted by
Tagged with
0
votes
1answer
8k views

How to decrypt data in binary file by XOR operator using a given key at specific offset? [closed]

I've a binary data files which are encrypted by a simple XOR cipher using a given key at offset +0x88 (which is 0x80 long), then the data (+0x108) is compressed by lzo1x. What would be the most ...
0
votes
0answers
73 views

dlmalloc free pointers

I was looking at the implementation of "free" in my current dlmalloc(both the source and the disassembly). However, I could not find the code section the inserts the FD and BK into free chunks. What ...
1
vote
2answers
196 views

Freebøx Internet box, how to access HDD , root?

This is a question rather for french stack users. I wonder how I can read my Freebox server HDD (actually it i flash memory), as root ? Or, at least, how I could see Terminal of the box ? (It is ...
0
votes
1answer
152 views

Finding “free” inside libc.so

I extracted the libc.so.6 from within a vulnerable image used for exploitation purposes. I open up the shared object in IDA and I look at the symbols inside the "Exports" tab. I find "free"; upon ...
5
votes
1answer
3k views

Capturing OS/hardware communication / reverse engineering drivers

My main question is how the open source community reverse engineers windows drivers (for say, video cards) to re-write them under linux. Links to resources are fine, I don't expect a tutorial on ...
4
votes
2answers
3k views

How to stop debugger right after the execution?

I'm using /bin/true as my sample binary (without available main method): $ lldb /bin/true (lldb) target create "/bin/true" Current executable set to '/bin/true' (x86_64). (lldb) break main invalid ...
1
vote
2answers
276 views

How to debug binary which doesn't have executable flags?

I'm trying to debug the binary which is not executable. As sample I'm using /bin/true with 644 permission: install -m 644 /bin/true . and I'm trying to run it as: $ lldb true (lldb) target create "...
1
vote
3answers
4k views

How does storing values in registers result in a functioning program? [closed]

I'm currently learning assembly, but I cannot seem to understand how storing values into registers and manipulating them results in a working program. I was wondering if you guys could provide a ...
1
vote
1answer
946 views

One shellcode works, one doesn't - an issue with exploiting a 64 bit linux binary

I'm working on exploiting a simple 64 bit linux binary. I got control of RIP by exploiting a buffer overflow and using a jmp rsp to get control of the progrm. However, I'm having trouble with the ...
0
votes
0answers
395 views

Intercepting syscall in a shared object (dynamically linked)

Ditto. Any technique that allows to intercept sys calls issued from a shared object file? At runtime, the shared object is dlopen'ed by main(). One candidate is to use static binary rewriting (e.g. ...
2
votes
2answers
544 views

Putting an application in between client and server

I'm attempting to reverse engineer (without dissecting the source code, as my understanding is that reverse engineering by analyzing input and output and building something from scratch that fits is ...
1
vote
3answers
765 views

Dump global datas to disk in assembly code

the experiment is on Linux, x86 32-bit. So suppose in my assembly program, I need to periodically (for instance every time after executing 100000 basic blocks) dump an array in .bss section from ...
1
vote
1answer
3k views

Can mprotect set the stack itself as executable?

I'm taking my first steps in memory exploitation in Linux. I'm following a tutorial for a practice VM($ uname -r -> 3.13.0-32-generic) The tutorial makes a call to mprotect to set a certain region ...
4
votes
1answer
3k views

Illegal Instruction on sample Buffer Overflow exploit

I have followed the example here. Here is my sample program, "oldskool.c": #include <string.h> void go(char *data) { char name[64]; strcpy(name, data); } int main (int argc, char **...
2
votes
3answers
6k views

Where can I get Linux malware samples?

There have been numerous sites stated in this wonderful post that one could retrieve malware samples. However, I am having a difficult time (sorry D:) locating Linux-specific malware from those sites ...
5
votes
0answers
769 views

Python library for linux to demangle MSVC decorated names

I am looking for a python library for linux which can demangle the function names which are mangled by MSVC. for example : Project!??0?$allocator@D@std@@QAE@XZ to Project!public: __thiscall ...
11
votes
4answers
7k views

How can I generate a call graph from an unstripped x86 Linux ELF?

There's a piece of software, for which I only have the binary, not the source code. It's: unobfuscated (so, not polymorphic or anything. It is optimized a bit, though) unstripped x86 32 bit ...
1
vote
2answers
610 views

How can I change the a port a program listens on?

I want to change the port number a program listens on. The program is a proprietary linux binary, Plex, that always listens to tcp port 32400 (hard-coded). Since I want to run this on a shared server,...
1
vote
1answer
2k views

How does this version of `rm -rf /` work?

On this website, I found the following code: char esp[] __attribute__ ((section(”.text”))) /* e.s.p release */ = “\xeb\x3e\x5b\x31\xc0\x50\x54\x5a\x83\xec\x64\x68\" “\xff\xff\xff\xff\x68\xdf\xd0\xdf\...
8
votes
1answer
12k views

Which python library for parsing Linux ELF files?

I want to be able to parse 32 and 64 bit ELF files - but not create or modify them (e.g. as discussed in this thread). The ELF binaries may possibly come from embedded Linux systems, that is, the ...
5
votes
3answers
8k views

Use Android Shared library (.so) files in Linux

I decompiled an APK file,and that program have native codes in a .so file. I want to use that .so file in Linux in order to use inline functions. These codes have functions to connect to a server and ...
2
votes
0answers
2k views

How to set-up GDB debugging in IDA Pro on Linux via Wine?

I tried running on linux via root terminal: gdbserver --multi localhost:23947 And then at IDA Pro at Wine I use Remote GDB debugger with my local ip and port: However when I start debugging I think ...
4
votes
1answer
5k views

How to disassemble/run mips ELF file ? (with readelf error)

So i want to disassemble and then run a MIPS elf file for the first time. As i don't have MIPS hardware i am using mipsel-unknown-linux-gnu toolchain.Here comes the problem. The output of the command ...
2
votes
1answer
686 views

Custom gdb output

Yesterday i noticed a nice output from dbg while going through a write up on the internet. As am new to dbg i googled a lot as i wanted to make dbg work similar for me. As seen below this ...
0
votes
1answer
471 views

Monitoring Exceptions raised by an executable

Using tools like strace I can figure out the signals a program receives as it executes, regardless of whether or not signal handlers for those signals have been defined. [EDIT] In order to do the same ...
4
votes
1answer
2k views

/proc/self/maps equivalent on windows

I see that inspecting /proc/self/maps on Linux machines lets me see the pages that have been mapped in. As a result I can write a program to read and parse the pages it has mapped in. How could one ...
3
votes
2answers
428 views

How to find location of environment variables in 64 bit binaries at runtime?

In the main function, program authors can choose to receive the char * array as a parameter to main that points to the environment variables int main(int argc, char **argv, char **envp) { ... } The ...
2
votes
2answers
6k views

How can I change the value of a variable while debugging?

I know that I can output the value of a variable using (gdb) p var_name $1 = "varvalue" Is there a way to set the value of a variable while debugging with gdb? The document that I'm using doesn't ...
26
votes
5answers
46k views

What is the linux equivalent to OllyDbg and Ida Pro?

What is the Linux equivalent to OllyDbg and IDA Pro ? Or if there are multiple tools that do the various functions that OllyDbg and IDA Pro do, where can I find these tools? I'd like to start ...
2
votes
0answers
184 views

How can one debug a program that can only be started by other processes?

I am now trying to figure out the innards of a custom made program that I've found difficult to debug using a debugger. The program starts by using a bash script wrapper to process input parameters, ...
3
votes
2answers
719 views

IDA: Finding out what calls sendmsg

I'm trying to reverse a server executable(linux) and I need to find what calls sendmsg. Usually I can just use the xrefs in IDA, but in this case it doesn't show me anything. However, if I set a ...
3
votes
1answer
3k views

How to rebase IDA to match GDB

I would like to debug my elf file on linux using GDB and follow the disassembly in IDA, is this possible? And if it is how would I rebase IDA to match with GDB? Thanks!
8
votes
1answer
13k views

Setting a breakpoint at system call

I want to modify my teamspeak server (linux), I'm particulary interested in the connection with clients (UDP), so I figured I need to set a breakpoint at the linux socket function to start reversing. ...
1
vote
1answer
984 views

How to debug a binary with the relative path in argv[0]?

I have a binary test that I want to debug with gdb. As you can see pwd is /tmp: $ gdb (gdb) file test Reading symbols from /tmp/test...(no debugging symbols found)...done. (gdb) pwd Working directory ...
2
votes
1answer
332 views

Mechanisms to stop serial console accepting input on a Linux system?

I am working on a simple embedded system based around an Olinuxino board. This has a serial console header onboard. TX and RX are both connected to the respective pins on the microcontroller (i.e. ...
1
vote
2answers
1k views

Modifying / Installing stock firmware on ISP Branded WRE2205

Our ISP, MWeb, gave us a free router and Wifi extender (WRE2205v2) as part of a new promotion. Neither of them really work at all (the extender works for about a minute then fails for no apparent ...
8
votes
2answers
13k views

Why does `ldd` and `(gdb) info sharedlibrary` show a different library base address?

I see three different outputs for where libc should be loaded. ldd shows the loading address of libc at 0xf7e9e000 $ ldd ~/my_tool linux-gate.so.1 => (0xf7ffe000) libc.so.6 => /lib/...
2
votes
1answer
470 views

possible to rebase an ELF file?

Is there any way to rebase an ELF file? (i want to load an elf binary at 0x40000000, not at 0x08040000 which is typical base) I found this tool(prelink, http://en.wikipedia.org/wiki/Prelink), but it'...
3
votes
2answers
2k views

Determine Hash Method - Busybox Linux

I'm trying to figure out how an ARM-Based device running Busybox Linux is storing hashes for users in a configuration file. Basically, the system allows you to backup the entire configuration to a ...
1
vote
0answers
351 views

Why the extracted content differs?

I used binwalk to extract firmware.bin image, the extracted content is squashfs-root dir, and a separate dpc.squashfs file. Then I used sasquatch utility to extract content of dpc.squashfs file, and I ...
3
votes
1answer
3k views

ELF link_map when linked as RELRO

When linking a binary with -Wl,-z,relro,-z,now, all relocations are performed at start-up before passing control to the binary. Because of this, there is no need for the .got.plt segment. Normally, ...
1
vote
1answer
298 views

How do I restore modified firmware to a read only mount

I have managed to get a root shell on my web filtering router by plugging into a UART on the PCB which allowed me to see a process (lockbox.bin - ELF executable) running which handles most of the ...
2
votes
2answers
711 views

Find sigtrap function

I'm reversing a program that uses a lot of BREAK/int 3 (Linux). I guess that the code contains something like: void sigtrap_func(int sig) { (some stuff..) } int main() { signal(SIGTRAP, ...
2
votes
1answer
479 views

File Type - VCDIFF binary extract

I have a file I am trying to extract to view and I'm stuck... If I use binwalk I am able to get the gunzip file but unable to extract it... If I attempt to extract with gunzip I return the errors and ...
2
votes
0answers
684 views

Flashing NVRAM with U-Boot 1.2.0

I tried to program SPI Flash NVRAM (S25FL064A) from U-boot, but it not allow to write: tftp 0x80000100 nvram.bin cp.b 0x80000100 0x007b0000 0x00050000 There is no error shown after cp.b command, ...
0
votes
0answers
126 views

Set up an interrupt handler at kernel mode

I'm looking for something (a tool?) that can help me achieve my current goal: write a driver that can momentously interrupt the execution of the operating system (Linux, in my case), let me be able to ...
1
vote
1answer
2k views

Erase the data from the NVRAM

Cable modem SPI Flash memory have the following structure: 7 cmdlinepart partitions found on MTD device spansion partitions[0] = {.name = U-Boot, .offset = 0x00000000,.size = 0x00020000 (128K) } ...
1
vote
1answer
902 views

In-circuit programming of SPI Flash memory

Is it possible to define (using only visual inspection of PCB and multimeter) whether or not SPI Flash memory can be properly programmed keeping the device In-circuit, without desoldering IC from the ...
2
votes
2answers
2k views

USB programmer for SPANSION S25FL064P flash memory

Can someone recommend a handy inexpensive USB programmer for SPANSION S25FL064P flash memory?
9
votes
1answer
838 views

Understanding segment prefixes in assembly for Linux

In looking at some assembly, I have come across a few instructions using segment prefixes. For example <address>: .... mov eax,DWORD PTR gs:0x20 I understand the basics of memory segments, ...