Questions tagged [linux]

A free and open source POSIX compatible operating system with a monolithic kernel and a kernel module system. Originally created by Linus Torvalds.

Filter by
Sorted by
Tagged with
1
vote
1answer
2k views

How does this version of `rm -rf /` work?

On this website, I found the following code: char esp[] __attribute__ ((section(”.text”))) /* e.s.p release */ = “\xeb\x3e\x5b\x31\xc0\x50\x54\x5a\x83\xec\x64\x68\" “\xff\xff\xff\xff\x68\xdf\xd0\xdf\...
1
vote
2answers
577 views

How can I change the a port a program listens on?

I want to change the port number a program listens on. The program is a proprietary linux binary, Plex, that always listens to tcp port 32400 (hard-coded). Since I want to run this on a shared server,...
1
vote
2answers
768 views

Is it possible copy and save bootloader using CLI telnet commands?

I need get copy of original Bootloader from device running embedded Linux. Is it possible copy and save bootloader using CLI telnet commands? I have full access to CLI interface. Is there way copy ...
1
vote
2answers
1k views

Modifying / Installing stock firmware on ISP Branded WRE2205

Our ISP, MWeb, gave us a free router and Wifi extender (WRE2205v2) as part of a new promotion. Neither of them really work at all (the extender works for about a minute then fails for no apparent ...
1
vote
3answers
69 views

How to input ascii control character into program?

I am working on a CTF where I need to pass an address as input to a program. This address contains the value 0x09 (the tab character). This is causing me problems, because it seems that bash is ...
1
vote
2answers
2k views

Basic shellcode doesn't work when read from stdin

I am working on a basic shellcode that will spawn a shell after getting called in a 32-bit program. Here is the shellcode i'm using: xor %eax,%eax push %eax push $0x68732f2f push $...
1
vote
1answer
957 views

Memory segment in IDA - ARM kernel

I just loaded up an ARM kernel image into IDA. When I boot up the ARM kernel and inspect the kernel symbols, I can see the following :- / $ cat /proc/kallsyms | head -n 10 00000000 t __vectors_start ...
1
vote
2answers
254 views

How to debug binary which doesn't have executable flags?

I'm trying to debug the binary which is not executable. As sample I'm using /bin/true with 644 permission: install -m 644 /bin/true . and I'm trying to run it as: $ lldb true (lldb) target create "...
1
vote
3answers
3k views

How does storing values in registers result in a functioning program? [closed]

I'm currently learning assembly, but I cannot seem to understand how storing values into registers and manipulating them results in a working program. I was wondering if you guys could provide a ...
1
vote
1answer
3k views

Can mprotect set the stack itself as executable?

I'm taking my first steps in memory exploitation in Linux. I'm following a tutorial for a practice VM($ uname -r -> 3.13.0-32-generic) The tutorial makes a call to mprotect to set a certain region ...
1
vote
2answers
918 views

Replace strings in object file

I have an object file under Linux with a lot of strings in it. I would like to replace all strings that represent a specific path in this object. I can see all the strings I need to change using the ...
1
vote
1answer
157 views

Length requirement on IOLI crackme input

So I'm just starting to learn reverse engineering and binary exploitation and going through the RPI course where the first lab set is drawn from the IOLI crackmes available on Github. I could post all ...
1
vote
2answers
188 views

Freebøx Internet box, how to access HDD , root?

This is a question rather for french stack users. I wonder how I can read my Freebox server HDD (actually it i flash memory), as root ? Or, at least, how I could see Terminal of the box ? (It is ...
1
vote
3answers
692 views

Dump global datas to disk in assembly code

the experiment is on Linux, x86 32-bit. So suppose in my assembly program, I need to periodically (for instance every time after executing 100000 basic blocks) dump an array in .bss section from ...
1
vote
1answer
897 views

How to debug a binary with the relative path in argv[0]?

I have a binary test that I want to debug with gdb. As you can see pwd is /tmp: $ gdb (gdb) file test Reading symbols from /tmp/test...(no debugging symbols found)...done. (gdb) pwd Working directory ...
1
vote
1answer
226 views

Binary file search tools [closed]

Is there a open-source Linux tool / utility for Linux platform that would recursively search for binary files (executable, shared / static objects, etc), in a folder and display?
1
vote
1answer
62 views

Unpacking, modifying, repacking and flashing a firmware

I've been trying to figure out how to modify the firmware on a DVR I bought for cheap recently. The built in software isn't great and doesn't offer any option for exporting video other than plugging a ...
1
vote
1answer
433 views

Unexpected SEGFAULT when there's apparently nothing that would cause it

This is a from a CTF problem I'm working on. Hopefully it's appropriate to ask this question here. Above is the GDB output when the segfault goes off. movaps is the offending instruction, meaning ...
1
vote
1answer
220 views

Sniffing TCP packets using Wireshark

I am trying to reverse engineer a decoder. The decoder contains a web server that makes sending/receiving information through the Internet possible. To do so I need to sniff the packets that the ...
1
vote
1answer
484 views

why saved rip changed by push?

I am doing a reverse homework. see the following pictures: as can be seen from this picture, before call push touch3, "saved rip" is at 0x5561dca8, which is equal to the current rsp(0x5561dca8). ...
1
vote
1answer
74 views

Unknown parameters in custom signal handler on Linux

0x0000000008001946: mov 0xa8(%rdx),%rax 0x000000000800194d: lea 0x28(%rdx),%rsi 0x0000000008001951: lea 0x2(%rax),%rdi 0x0000000008001955: add $0xe,%rax 0x0000000008001959: ...
1
vote
1answer
177 views

Question regarding ASLR

If I have a binary file which does not have ASLR enabled. However, the libc file it uses has ASLR enabled, then will the address of system() in libc file be randomized every time? Or the address will ...
1
vote
1answer
77 views

Redirecting Program Output from /dev/*char_device* to Text File

I am currently trying to reverse an IoT machine running the 2.6 Linux Kernel on which I have root. On this machine, software writes to /dev/some_device to control what I believe to be are GPIO pins ...
1
vote
1answer
597 views

How to extract an unknown archive file? Currently Im trying to open *.pak (P5CK)

I have a console game called Timesplitters Future Perfect(iso file). I were able to extract and got bunch of files. *.pak being one type I would like to open and see. I opened up a hex editor and saw ...
1
vote
1answer
135 views

3 questions on Assembly - meaning of code, Decompilation in Linux, Higher level perspective,

Following the question here (3 questions on assembly - syntax, meaning, and equivalent in high level code (eg C++)), I would like to know for the same x86 code in AT&T syntax: xor $0x20, (%eax) ...
1
vote
3answers
3k views

How to extract content of NVRAM file?

How to extract content from NVRAM file? NVRAM type is SPI Serial NOR Flash. NVRAM has been copied as mtdblock partition. An embedded device that run Linux v2.6.18_pro500. Linux version 2.6.18_pro500 ...
1
vote
1answer
317 views

What checksum algorithm is this network protocol using?

I've been working my way through an undocumented TCP-based protocol by monitoring traffic with tcpdump, Wireshark, and some Python packages (scapy, numpy) with good luck so far, but I've hit a wall ...
1
vote
1answer
742 views

Kernel dealing with the section headers in an ELF

I recently read that the kernel and the dynamic loader mostly deal with the program header tables in an ELF file and that assemblers, compilers and linkers deal with the section header tables. The ...
1
vote
1answer
60 views

I need help reverse engineering my ereader (trying to get into the shell)

I'm trying to reverse engineer my E-Reader. It's a Denver EBO-620. I want to change the off screen image and add my own fonts. With help of Reddit I've managed to log the startup sequence (shown down ...
1
vote
1answer
91 views

Linux Embedded board - Kernel Panic problems

I need to duplicate an old embedded board based on a Yocto-based Linux. I have bought a new board with the same part number and now I need to put the old software in the new board (the new board has ...
1
vote
1answer
264 views

`qemu-mips-static` chroot causing `Invalid ELF image` error

I'm trying to emulate a MIPS binary on my Ubuntu 16.04 x86 system, but I'm not able to. I chroot into the squashfs-root filesystem that I got from binwalking the firmware image. kan3k1@kaido:~/...
1
vote
1answer
605 views

Changing entry-point of and ELF file

I'm trying to conduct a little experiment which basically consists of changing the EP of an ELF file and executing an exit(9) syscall, without returning to the OEP. As shown in the image everything ...
1
vote
1answer
48 views

Find out if address store in heap or stack

While dynamic debugging with ida and gdb-server on binary file running on linux , I saw address that store some value. How can I know if this address allocated in stack or in heap?
1
vote
1answer
321 views

Fork and Waitpid calls in a CTF linux binary

I'm doing one of my first linux crackmes. In the first blocks of code, it goes inside some anti-debug routine and inside one of those it forks and after it calls a waitpid routine. I can verify it ...
1
vote
1answer
878 views

Rebuilding firmware back to binary file

I used Binwalk to extract firmware files, extracted content include 2 folders and one binary file. squashfs-root _351C.extracted 351C Squashfs-root contains file system, '_351C.extracted' folder ...
1
vote
2answers
1k views

IDA Pro - Applying function signatures

I have three files: ELF executable, ELF dynamically linked library (.so), C headers file (.h) with function signatures and related structures for that library. #1 imports a number of functions from #...
1
vote
1answer
99 views

Is it possible to restart over a program by calling an entry point function?

I was wondering if it was possible to restart a program (ignoring previously mapped files) with different argument by either calling main() or a glibc entry point function.
1
vote
1answer
274 views

Is it possible to rebuild an nexe file if I can read at arbitrary untrusted memory addresses?

Ok, I’m in a remote situation where I don’t have access to the remote filesystem but where I can run arbitrary python code (except I can’t fork processes and I don’t have access to ulimit and uname). ...
1
vote
1answer
911 views

One shellcode works, one doesn't - an issue with exploiting a 64 bit linux binary

I'm working on exploiting a simple 64 bit linux binary. I got control of RIP by exploiting a buffer overflow and using a jmp rsp to get control of the progrm. However, I'm having trouble with the ...
1
vote
1answer
264 views

How do I restore modified firmware to a read only mount

I have managed to get a root shell on my web filtering router by plugging into a UART on the PCB which allowed me to see a process (lockbox.bin - ELF executable) running which handles most of the ...
1
vote
1answer
1k views

Erase the data from the NVRAM

Cable modem SPI Flash memory have the following structure: 7 cmdlinepart partitions found on MTD device spansion partitions[0] = {.name = U-Boot, .offset = 0x00000000,.size = 0x00020000 (128K) } ...
1
vote
1answer
822 views

In-circuit programming of SPI Flash memory

Is it possible to define (using only visual inspection of PCB and multimeter) whether or not SPI Flash memory can be properly programmed keeping the device In-circuit, without desoldering IC from the ...
1
vote
1answer
1k views

ldd showing absolute path only

Under what circumstances does the output of ldd have only the absolute path? In the below eg, /usr/lib/arm-linux-gnueabihf/libcofi_rpi.so and /lib/ld-linux-armhf.so.3. pi@raspberrypi ~ $ uname -a ...
1
vote
1answer
54 views

hooking libhoudini on x86 emulator

I'm trying to hook libhoudini to debug an application instruction by instruction using frida but frida not supports it i need a example on how can this be achieved! I'm using a x86 emulator to run arm ...
1
vote
0answers
49 views

Replacing bytes from start of every function with IDA Pro

I want to fix a .plt segment in IDA Pro by replacing 12 bytes from start of every function in the .plt segment with the ones I specify. I want to just make each function return so I'm replacing ...
1
vote
0answers
48 views

Same USB packet (Python/user vs C/kernel) but different result

I'm making a Linux module (my first one) for a closed-source, enclosed (no hardware access) device. Using Wireshark I found what to send and where, so I tried the following command in user space ...
1
vote
2answers
60 views

Newbie problems exploiting a format string vulnerability

I encountered a print format vulnerability challenge in a CTF. I don't know anything about these vulnerabilities, so I'm working my way through Saif El-Sherei's format string exploitation tutorial ...
1
vote
0answers
157 views

Endoscope Camera YPC99 - how to stream on linux

I'm trying to stream video from endoscope camera YPC99 on linux PC using the WiFi connection. From what I have found so far the camera is using IP 192.168.1.1. It supports RTSP protocol on port 7070 (...
1
vote
2answers
192 views

Repacking an embedded initramfs

I'd like to modify some of the init scripts in an initramfs that is embedded in a kernel bzImage. I know I can modify them by not changing the size of any files (e.g. by commenting out lines, and ...
1
vote
0answers
21 views

Format of Alcatel_Lucent I-240W-A backup file

I am trying to modify the backup file of this router in order to change some configurations. Here is the structure I have until now: 16 bytes of the header, zlib compressed xml with the ...