35 votes
Accepted

Approach to extract useful information from binary file

General Prerequisites When analyzing binaries, it is important to be able to put what is observed into context. For example, how can CPU instructions be differentiated from data in a binary with a ...
  • 6,948
34 votes

What is PLT/GOT?

Let me summarize the links given at https://reverseengineering.stackexchange.com/a/1993/12321 without going into serious disasembly analysis for now. When the Linux kernel + dynamic linker is going ...
24 votes

Decoding an unknown image format with "DREK" signature (*.drk)

[Complete ReEdit3] further progress & shortening the text to fit the 30KB limit First some input how I got here (for future readers trying to do the same for different format). Image Data size ...
  • 1,384
22 votes
Accepted

How to make radare2 work for a large binary?

It is not a good practice to run full analysis of your binary at the startup and it also isn't encourged by radare. Running aaa by default is a heavy action and absolutely not recommended or needed in ...
  • 8,779
20 votes
Accepted

How to generate the call graph of a binary file?

You can use radare2 or one of the alternatives below to generate a full call-graph in dot format. radare2 Installation First of all, install radare2 from git repository: $ git clone https://...
  • 8,779
17 votes

What are some ways to pass raw bytes to a program via the Linux terminal?

If you need null bytes, you can write them to a file and use the file as input for the program, e.g.: echo -e -n "\x00\xFF\xAB" > file.bin program < file.bin You can use also use xxd ...
  • 35.5k
16 votes
Accepted

Remove code signature from a Mac binary

There are tools for that, as well as a codesign flag --remove-signature First two should work the same. The codesign flag is undocumented and so YMMV (A user reported in a comment the codesign ...
  • 11.6k
16 votes
Accepted

Import table vs Import Address Table

As general, I recommend reading the PE Format documentation on MSDN regarding the PE structure. Import Table The Import Table is actually called "Import Directory Table" and contains entries for ...
  • 8,779
16 votes
Accepted

Difference between Main and Entry

Main is usually a programmer-defined entry point, while entry is defined by the compiler, it's doing many other operations such as libc initializations, heap allocation, and so on, and eventually, ...
15 votes

how can I diff two x86 binaries at assembly code level?

There are various great alternatives here. However, all of them seem to be unmaintained. The tool I recommend you is Diaphora https://github.com/joxeankoret/diaphora (Disclaimer: I'm the author). Is a ...
  • 4,345
14 votes
Accepted

Why do reversers nowadays reverse engineer using decompilers and not disassemblers?

Although these terms are being used interchangeably, there is an intrinsic difference between disassembler and decompiler definitions traditionally. Let's first consider common steps involved in ...
  • 1,547
12 votes

How do I reverse engineer .so files found in android APKs?

Use android-ndk, https://developer.android.com/ndk/downloads/index.html. You can use the toolchains inside the ndk to perform the type of disassembling you want to. For e.g. if I decompile an apk and ...
12 votes

Extract files from a bin firmware

Since version 0.50, binwalk has a -e option to extract files. Unfortunately, the manual doesn't tell you this, but if you invoke binwalk -version, it tells you -e, --extract=[file] ...
12 votes

How do you can you disassemble and dump an entire binary?

You can use the special "'$' variables" $s to get the size of your binary, and pass it as an argument to the pd command to disassemble the whole file: [0x004048bf]> pd $s Do you want to print 188....
  • 2,496
11 votes

Control flow graph reconstruction projects

Extracting control flow graph in JSON with radare2: $> python import r2pipe r2 = r2pipe.open("/bin/ls") r2.cmd("aaa") # See radare.today/posts/analysis-by-default/ cfg = r2.cmdj("agj") https://...
  • 870
11 votes
Accepted

Extracting a NAND flash dump with OOB data

So, I have figured it out myself in the end. I'll try to describe the process. First, a bit of background on NAND: it is organized in pages which are grouped into blocks. You can read or write a ...
  • 35.5k
11 votes
Accepted

How to print the value of register with Radare 2

Printing the registry values in radare2 is quite simple. All registers You can print all the General Purpose registers using dr: [0x55bea3305070]> dr rax = 0x55bea3305070 rbx = 0x00000000 rcx = ...
  • 8,779
10 votes

Visualizing ELF binaries

BinView is a prototype for a tool for binary data visualization GitHub repository
  • 101
10 votes
Accepted

What are some ways to pass raw bytes to a program via the Linux terminal?

Use echo -e and pipe to your program's input. Example: echo -e "\x41\x42\x43\x44" | <executable> Will write ABCD as input. edit: You can pass null-bytes
  • 852
10 votes

What does 'test al, al' mean?

In x86 assembly, al is the least significant byte of eax register, which is typically used to return values from function calls. The test al,al is a bitwise AND operation between al and itself. If ...
  • 852
9 votes
Accepted

Protect data stored in binary

I would start with not have critical strings in memory in linear manner Instead each character can be offseted by some offset like by table mixing all the strings together. For example you got ...
  • 1,384
9 votes
Accepted

Heap Chunk Structure Does Not Contain Previous Section Info

The diagram you linked to seems to be wrong. The size of the previous chunk is stored in the current chunk iff, the previous chunk is free. This image is more appropriate of what an allocated heap ...
  • 5,950
9 votes
Accepted

Correct way to understand local_ in ghidra disassembly

Since local variables are usually placed on the stack in x86 and esp register can change during function execution, it is more convenient to save the value of esp register on function entry and access ...
  • 3,289
8 votes
Accepted

Extract files from a bin firmware

You can use the -D option to dd out sections based on signature. For example, to extract out the ELF parts, do: binwalk -D "elf 32-bit lsb shared object":.so image.bin Note the lowercase signature ...
  • 96
8 votes
Accepted

Understanding the loop disassembly

var_D8 is your int arr[50]. You can recognize it quickly solely by its name : 50 * sizeof(int) = 200 = 0xC8. The next variable on the stack is numb_of_elements which is positionned on -0x10 on the ...
  • 578
8 votes
Accepted

Reverse engineer 4-bit CRC in LG IR packet

This seems to be a checksum, just as you state in your question, not a CRC as mentioned in the header. Group the values into blocks of 4 bits, add them, ignore overflow (in these examples, ignore ...
8 votes

Reverse Engineering a Firmware. Someone can help me?

Finding: NGA_FW_CURRENT.BIN is a compressed Videx microchip firmware image file. Preliminary Remarks There is conflicting background information given in the comments about the file alleged to be ...
  • 6,948
8 votes

How to generate the call graph of a binary file?

You might want to give angr a try. Load the binary. Suppose p is the angr Project instance. Generate a CFG: cfg = p.analyses.CFG(show_progressbar=True). Access/traverse the call graph (which is a ...
  • 194
7 votes
Accepted

Parsing/Rescuing corrupted IDA database

I published some tools on github which can do just that: https://github.com/nlitsme/pyidbutil and https://github.com/nlitsme/idbutil. The first is written in python, the second in C++, both have ...
7 votes
Accepted

Visual studio memory allocation reverse engineering

You may want to read up on assembly before attempting to reverse engineer. esi and edi are pushed on the stack because the compiler thought this routine modifies them. (It is wrong because only edi ...
  • 2,324

Only top scored, non community-wiki answers of a minimum length are eligible