73
PLT stands for Procedure Linkage Table which is, put simply, used to call external procedures/functions whose address isn't known in the time of linking, and is left to be resolved by the dynamic linker at run time.
GOT stands for Global Offsets Table and is similarly used to resolve addresses. Both PLT and GOT and other relocation information is explained ...
66
The .so file is a compiled library, in most cases from C or C++ source code. .so stands for Shared Object, it doesn't have anything to do with obfusation, it just means someone wrote parts of the app in C.
In some cases, there is existing C code and it's just easier for the programmer to build a JNI interface to call the library from java; in other cases, ...
38
(reposting my SO answer to a similar question)
In many cases it is possible to identify the compiler used to compile the code, and from that, the original language.
Most language implementations include some kind of runtime library to implement various high-level operations of the language. For example, C has the CRT which implements file I/O operations (...
27
Unless I'm mistaken, it sounds like you are looking for a binary diffing tool. Some good options are below. These all require IDA Pro.
DarunGrim (open-source)
BinDiff (commercial)
eEye Binary Diffing Suite (use archive.org to download the installer)
25
The paper Static Analysis of x86 Executables explains overlapping instructions quite well. The following example is taken from it (page 28):
0000: B8 00 03 C1 BB mov eax, 0xBBC10300
0005: B9 00 00 00 05 mov ecx, 0x05000000
000A: 03 C1 add eax, ecx
000C: EB F4 jmp $-10
000E: 03 C3 add eax, ebx
0010: C3 ret
By ...
24
General Prerequisites
When analyzing binaries, it is important to be able to put what is observed into context. For example, how can CPU instructions be differentiated from data in a binary with a non-standard format? This requires some background knowledge of computer systems in general. I would argue that before any attempt at reverse engineering firmware ...
22
[Complete ReEdit3] further progress & shortening the text to fit the 30KB limit
First some input how I got here (for future readers trying to do the same for different format).
Image Data size
Comparing provided background image to its raw image size xs*ys reveal direct dependence Which implies no compression or one that has always the same pixel to ...
19
The .bss has no content. It's simply a tip to the loader to preallocate some space when starting the program. It will be all 0s at the execution and won't hold any useful information until the program writes to it. After that, you can use a debugger to dump the memory and explore its content.
Check the Wikipedia page for more information.
18
You can also try radiff2 (Which doesn't require IDA ;)), which is a tool from the radare toolsuite. It supports delta diffing (-d), graphdiff (-g), and lots of related goodies.
18
Besides Guntram's suggestions, check out the retargetable decompiler aka retdec. It can decompile the binary to Python or C code. At least for me, it reads easier than pure assembly (and it works for ARM binaries).
It works very well for sketching you the rough workings of the shared object.
A plugin for select IDA versions exists, but the main limitation ...
18
Correct disassembly of an executable is known to be undecidable in the general case (this problem can obviously be related to the famous halting problem of a Turing machine).
So, extracting all the basic blocks of a binary program is a very difficult problem.
Yet, there are several techniques to try to approach a best effort coverage of the instructions. ...
17
It is not a good practice to run full analysis of your binary at the startup and it also isn't encourged by radare. Running aaa by default is a heavy action and absolutely not recommended or needed in most of the cases.
As stated in this execllent post from radare's blog:
Code analysis is not a quick operation, and not even predictable or taking a ...
15
It's also known as the 'jump in the middle' trick.
explanation
execution rules
most instructions take more than one byte to be encoded
they can take up to 15 bytes on modern CPUs
execution can start at any position as long as permissions are valid
so any byte following the first one of an instruction can be re-used to start another instruction.
...
15
from its feature page:
Multi-architecture and multi-platform
GNU/Linux, Android, *BSD, OSX, iPhoneOS, Windows{32,64} and Solaris
x86{16,32,64}, dalvik, avr, arm, java, powerpc, sparc, mips, bf, csr, m86k, msil, sh
pe{32,64}, [fat]mach0{32,64}, elf{32,64}, te, dex and java classes
Highly scriptable
Vala, Go, Python, Guile, Ruby, Perl, Lua, Java, ...
15
When you have a hammer, all the problems look like nails...
I´ve studied something called Normalized Compression Distance - NCD - some time ago, and I'd give it a try if I had a problem similar to yours.
I´d make a database of examples. Would take 20 programs for each architecture you want to know, with variable sizes, and save them.
When confronted with ...
15
.NET could be identified by import which you can see using dependency warker - check if there is an import of mscorlib.dll which is a core lib of .net framework.
C++ can be identified by
looking at the assembly - it uses this call convention.
PEid can show partial info about what compiler and run-time were used. In general it uses list of signature for ...
14
To be a malware analyst, the minimum knowledge typically needed is:
Assembly language
Operating system internals
Deobfuscation and anti-anti-debugging techniques
Obviously, there are other useful areas of knowledge for malware analysis (like an understanding of network protocols, exploit analysis techniques, knowledge of VB P-code and JavaScript and .NET ...
14
funcap uses IDA's debugging API to record function
calls in a program together with their arguments (before and after).
This is very useful when dealing with malware which uses helper
functions to decrypt their strings, or programs which make many
indirect calls.
14
That site is good if you're familiar with how the encoding works but if you're just starting I'd skip it for now.
The best starting point is probably the Intel's Architectures Software Developer Manuals. Have a look at CHAPTER 2 INSTRUCTION FORMAT in the Volume 2, and also the appendices, particularly APPENDIX B INSTRUCTION FORMATS AND ENCODINGS and ...
14
I downloaded the archive you referenced and the first thing I noticed was that the firmware files are very heavy in the 0x80 - 0xff range. Inverting each byte resulted in a much nicer byte distribution and looked like it had some structure but still not quite right. I assume that since they went as far as inverting the bytes, they might have done some bit-...
14
You can use radare2 or one of the alternatives below to generate a full call-graph in dot format.
radare2 Installation
First of all, install radare2 from git repository:
$ git clone https://github.com/radare/radare2.git
$ cd radare2
$ ./sys/install.sh
Analysis
After you've downloaded and installed radare2, open your binary and perform analysis on it ...
13
The question is wrongly placed
You are asking the wrong question. Literally. The question is by no means why it isn't possible (it is possible in many cases). The better question is: why it isn't practical?
It's interesting to ask it, nevertheless.
Why not use hardware assisted virtualization?
For starters I've had arguments in the past with certain ...
12
There are some tools that can scan binary files for common opcodes found in various architectures. Binwalk's -A option does this for example (it scans for ARM/MIPS/x86 and several other architectures).
12
You can also try a dynamic approach by hooking APIs and observing arguments and return values. This will allow you to look at data going into crypto APIs, which may help a lot when dealing with network protocols. Check out the Frida instrumentation toolkit for an open source cross-platform solution (Android, iOS, Windows, Mac and Linux). There's a tutorial ...
11
BAP is mostly a rewrite of BitBlaze, so feature-wise there are many common features. However, many of these have been re-written or re-designed for BAP.
Common features:
Lifting of usermode, x86 instructions
Datafow analysis module
Dominator analysis
CFG and SSA representations
Optimization framework
Verification condition generation
Dependency graphs
...
10
Also, there is Turbodiff, it's an IDA pro plugin.
Haven't used it yet, though so I can't say anything about the quality of the tool.
10
There are various great alternatives here. However, all of them seem to be unmaintained. The tool I recommend you is Diaphora https://github.com/joxeankoret/diaphora (Disclaimer: I'm the author). Is a pure Python plugin for IDA Pro for doing program diffing, is the only one that can import/export structures, enumerations, etc..., the only one that makes use ...
10
This is self-modifying code. The garbage instructions that you see will be altered dynamically, this way:
seg000:00000000 mov edx, 61666A1Fh
seg000:00000005 fincstp
seg000:00000007 fnstenv byte ptr [esp-0Ch]
seg000:0000000B pop esi ; EIP
Now esi points to the location of ...
10
You could use the #entropy command radare2. binwalk can calculate entropy, too.
Radare2
From the manual page of Radare2:
#[hash] Calculates the sha1, sha256, sha384, sha512, par, xor,
xorpair, hamdist, mod255, crc16, crc32, md4, md5, entropy of
the current block from the selected seek
So, using this command is as follow:
$ ...
10
You can use the special "'$' variables" $s to get the size of your binary, and pass it as an argument to the pd command to disassemble the whole file:
[0x004048bf]> pd $s
Do you want to print 188.0K chars?
For more information on '$' variables available see ?$?.
Only top voted, non community-wiki answers of a minimum length are eligible
