38 votes

What is PLT/GOT?

Let me summarize the links given at https://reverseengineering.stackexchange.com/a/1993/12321 without going into serious disasembly analysis for now. When the Linux kernel + dynamic linker is going ...
Ciro Santilli OurBigBook.com's user avatar
35 votes
Accepted

Approach to extract useful information from binary file

General Prerequisites When analyzing binaries, it is important to be able to put what is observed into context. For example, how can CPU instructions be differentiated from data in a binary with a ...
julian's user avatar
  • 7,078
24 votes

Decoding an unknown image format with "DREK" signature (*.drk)

[Complete ReEdit3] further progress & shortening the text to fit the 30KB limit First some input how I got here (for future readers trying to do the same for different format). Image Data size ...
Spektre's user avatar
  • 1,384
24 votes
Accepted

How to make radare2 work for a large binary?

It is not a good practice to run full analysis of your binary at the startup and it also isn't encourged by radare. Running aaa by default is a heavy action and absolutely not recommended or needed in ...
Megabeets's user avatar
  • 8,919
21 votes
Accepted

How to generate the call graph of a binary file?

You can use radare2 or one of the alternatives below to generate a full call-graph in dot format. radare2 Installation First of all, install radare2 from git repository: $ git clone https://...
Megabeets's user avatar
  • 8,919
18 votes
Accepted

Remove code signature from a Mac binary

There are tools for that, as well as a codesign flag --remove-signature First two should work the same. The codesign flag is undocumented and so YMMV (A user reported in a comment the codesign ...
NirIzr's user avatar
  • 11.7k
17 votes
Accepted

Import table vs Import Address Table

As general, I recommend reading the PE Format documentation on MSDN regarding the PE structure. Import Table The Import Table is actually called "Import Directory Table" and contains entries for ...
Megabeets's user avatar
  • 8,919
17 votes

What are some ways to pass raw bytes to a program via the Linux terminal?

If you need null bytes, you can write them to a file and use the file as input for the program, e.g.: echo -e -n "\x00\xFF\xAB" > file.bin program < file.bin You can use also use xxd ...
Igor Skochinsky's user avatar
  • 36.4k
16 votes
Accepted

Difference between Main and Entry

Main is usually a programmer-defined entry point, while entry is defined by the compiler, it's doing many other operations such as libc initializations, heap allocation, and so on, and eventually, ...
macro_controller's user avatar
14 votes
Accepted

Why do reversers nowadays reverse engineer using decompilers and not disassemblers?

Although these terms are being used interchangeably, there is an intrinsic difference between disassembler and decompiler definitions traditionally. Let's first consider common steps involved in ...
R4444's user avatar
  • 1,797
12 votes

How do I reverse-engineer .so files found in Android APKs?

Use android-ndk, https://developer.android.com/ndk/downloads/index.html. You can use the toolchains inside the ndk to perform the type of disassembling you want to. For e.g. if I decompile an apk and ...
Shailesh Mota's user avatar
11 votes

Control flow graph reconstruction projects

Extracting control flow graph in JSON with radare2: $> python import r2pipe r2 = r2pipe.open("/bin/ls") r2.cmd("aaa") # See radare.today/posts/analysis-by-default/ cfg = r2.cmdj("agj") https://...
Maijin's user avatar
  • 880
11 votes
Accepted

Extracting a NAND flash dump with OOB data

So, I have figured it out myself in the end. I'll try to describe the process. First, a bit of background on NAND: it is organized in pages which are grouped into blocks. You can read or write a ...
Igor Skochinsky's user avatar
  • 36.4k
11 votes
Accepted

How to print the value of register with Radare 2

Printing the registry values in radare2 is quite simple. All registers You can print all the General Purpose registers using dr: [0x55bea3305070]> dr rax = 0x55bea3305070 rbx = 0x00000000 rcx = ...
Megabeets's user avatar
  • 8,919
11 votes

What does 'test al, al' mean?

In x86 assembly, al is the least significant byte of eax register, which is typically used to return values from function calls. The test al,al is a bitwise AND operation between al and itself. If ...
Yotamz's user avatar
  • 892
10 votes
Accepted

What are some ways to pass raw bytes to a program via the Linux terminal?

Use echo -e and pipe to your program's input. Example: echo -e "\x41\x42\x43\x44" | <executable> Will write ABCD as input. edit: You can pass null-bytes
Yotamz's user avatar
  • 892
9 votes

Import table vs Import Address Table

First, beside “yours” two tables, I introduce a third one, the Import Lookup Table. Side by side with the Import Address Table, these two tables look like in this simplified picture: This picture ...
MarianD's user avatar
  • 1,120
9 votes
Accepted

Heap Chunk Structure Does Not Contain Previous Section Info

The diagram you linked to seems to be wrong. The size of the previous chunk is stored in the current chunk iff, the previous chunk is free. This image is more appropriate of what an allocated heap ...
0xec's user avatar
  • 6,040
9 votes
Accepted

Correct way to understand local_ in ghidra disassembly

Since local variables are usually placed on the stack in x86 and esp register can change during function execution, it is more convenient to save the value of esp register on function entry and access ...
bart1e's user avatar
  • 3,369
8 votes
Accepted

What is the "standard" approach to find loop in binary code?

The classic, compiler theoretic answer to this question is to build a control flow graph and then do a graph analysis to identify natural loops. I believe algorithms for this can be found in the ...
Brendan Dolan-Gavitt's user avatar
8 votes

Reverse Engineering a Firmware. Someone can help me?

Finding: NGA_FW_CURRENT.BIN is a compressed Videx microchip firmware image file. Preliminary Remarks There is conflicting background information given in the comments about the file alleged to be ...
julian's user avatar
  • 7,078
8 votes

How to generate the call graph of a binary file?

You might want to give angr a try. Load the binary. Suppose p is the angr Project instance. Generate a CFG: cfg = p.analyses.CFG(show_progressbar=True). Access/traverse the call graph (which is a ...
Fish's user avatar
  • 194
7 votes

How to identify the structure of this specific data file?

It's certainly not a well known format. A quick glance at the file with a hex viewer shows that it mainly consists of records that all have similar, but not identical, size and layout; the very end of ...
Guntram Blohm's user avatar
7 votes
Accepted

Parsing/Rescuing corrupted IDA database

I published some tools on github which can do just that: https://github.com/nlitsme/pyidbutil and https://github.com/nlitsme/idbutil. The first is written in python, the second in C++, both have ...
Willem Hengeveld's user avatar
7 votes
Accepted

Control flow graph reconstruction projects

For now, the most efficient approaches in practice seems to follow the principle of symbolic execution. This technique, originally developed to automatically build-up a set of test cases based on a ...
perror's user avatar
  • 18.9k
7 votes
Accepted

Simple carving of zip file using binwalk

Binwalk produces multiple large files, because the zlib header does not contain any information about the size of the compressed data. The following steps should be performed to extract the zip files:...
ebux's user avatar
  • 1,759
7 votes
Accepted

Running a binary identified as an ARM excutable by binwalk --disasm

Obstacles One of the difficulties associated with analyzing firmware is that firmware binaries do not usually have a standard format and do not segregate code and data in a standard manner like ELF ...
julian's user avatar
  • 7,078
7 votes
Accepted

reversing stripped & statically linked binary with radare2

Seems like lscan is written to work with IDA. However, lscan is based on FLIRT signature files which can be also read by radare2 (See the Zignatures section of this answer). There are several things ...
Megabeets's user avatar
  • 8,919
7 votes
Accepted

Flare-ON#3: Problem understanding some parts in the program

Should not the location be empty or have some other values than assembly instructions...? The answer is "no". As the author stated in the write-up, this binary is self-modifying: At this stage you ...
Megabeets's user avatar
  • 8,919
7 votes
Accepted

Radare2 Find command line arguments and location in stack

radare2 currently doesn't flags argv and argc. Yet, it shouldn't be something complicated to implement. Although these arguments are not flagged by radare2, they can be easily be visible to us by ...
Megabeets's user avatar
  • 8,919

Only top scored, non community-wiki answers of a minimum length are eligible