99 votes
Accepted

How do I reverse engineer .so files found in android APKs?

The .so file is a compiled library, in most cases from C or C++ source code. .so stands for Shared Object, it doesn't have anything to do with obfusation, it just means someone wrote parts of the app ...
user avatar
33 votes
Accepted

Approach to extract useful information from binary file

General Prerequisites When analyzing binaries, it is important to be able to put what is observed into context. For example, how can CPU instructions be differentiated from data in a binary with a ...
user avatar
  • 6,859
30 votes

What is PLT/GOT?

Let me summarize the links given at https://reverseengineering.stackexchange.com/a/1993/12321 without going into serious disasembly analysis for now. When the Linux kernel + dynamic linker is going ...
user avatar
25 votes

How do I reverse engineer .so files found in android APKs?

Besides Guntram's suggestions, check out the retargetable decompiler aka retdec. It can decompile the binary to Python or C code. At least for me, it reads easier than pure assembly (and it works for ...
user avatar
  • 351
24 votes

Decoding an unknown image format with "DREK" signature (*.drk)

[Complete ReEdit3] further progress & shortening the text to fit the 30KB limit First some input how I got here (for future readers trying to do the same for different format). Image Data size ...
user avatar
  • 1,374
22 votes
Accepted

How to make radare2 work for a large binary?

It is not a good practice to run full analysis of your binary at the startup and it also isn't encourged by radare. Running aaa by default is a heavy action and absolutely not recommended or needed in ...
user avatar
  • 8,639
21 votes
Accepted

Why I can not directly get the content of `.bss` section?

The .bss has no content. It's simply a tip to the loader to preallocate some space when starting the program. It will be all 0s at the execution and won't hold any useful information until the program ...
user avatar
  • 261
20 votes

Code Coverage - Fuzzing

Correct disassembly of an executable is known to be undecidable in the general case (this problem can obviously be related to the famous halting problem of a Turing machine). So, extracting all the ...
user avatar
  • 18.1k
20 votes
Accepted

How to generate the call graph of a binary file?

You can use radare2 or one of the alternatives below to generate a full call-graph in dot format. radare2 Installation First of all, install radare2 from git repository: $ git clone https://...
user avatar
  • 8,639
17 votes

What are some ways to pass raw bytes to a program via the Linux terminal?

If you need null bytes, you can write them to a file and use the file as input for the program, e.g.: echo -e -n "\x00\xFF\xAB" > file.bin program < file.bin You can use also use xxd ...
user avatar
  • 34.8k
16 votes
Accepted

Remove code signature from a Mac binary

There are tools for that, as well as a codesign flag --remove-signature First two should work the same. The codesign flag is undocumented and so YMMV (A user reported in a comment the codesign ...
user avatar
  • 11.4k
16 votes
Accepted

Import table vs Import Address Table

As general, I recommend reading the PE Format documentation on MSDN regarding the PE structure. Import Table The Import Table is actually called "Import Directory Table" and contains entries for ...
user avatar
  • 8,639
16 votes
Accepted

Difference between Main and Entry

Main is usually a programmer-defined entry point, while entry is defined by the compiler, it's doing many other operations such as libc initializations, heap allocation, and so on, and eventually, ...
user avatar
15 votes

how can I diff two x86 binaries at assembly code level?

There are various great alternatives here. However, all of them seem to be unmaintained. The tool I recommend you is Diaphora https://github.com/joxeankoret/diaphora (Disclaimer: I'm the author). Is a ...
user avatar
  • 4,315
15 votes
Accepted

What's the difference between a disassembler, debugger and decompiler?

These terms are currently defined on this site as follows: Disassembler: A disassembler is a software tool which transforms machine code into a human readable mnemonic representation called ...
user avatar
14 votes

Why are GOT and PLT still present in Linux static stripped binaries?

There are a plethora of things programmers do not know about how ELF binaries work internally. And, unfortunately, there's almost no solid references apart from two or three which broadly cover the ...
user avatar
  • 2,603
14 votes

How do I reverse engineer .so files found in android APKs?

You can also try a dynamic approach by hooking APIs and observing arguments and return values. This will allow you to look at data going into crypto APIs, which may help a lot when dealing with ...
user avatar
14 votes
Accepted

Finding the actual Thumb code in firmware

I downloaded the archive you referenced and the first thing I noticed was that the firmware files are very heavy in the 0x80 - 0xff range. Inverting each byte resulted in a much nicer byte ...
user avatar
  • 501
13 votes
Accepted

Why do reversers nowadays reverse engineer using decompilers and not disassemblers?

Although these terms are being used interchangeably, there is an intrinsic difference between disassembler and decompiler definitions traditionally. Let's first consider common steps involved in ...
user avatar
  • 1,437
12 votes

How do I reverse engineer .so files found in android APKs?

Use android-ndk, https://developer.android.com/ndk/downloads/index.html. You can use the toolchains inside the ndk to perform the type of disassembling you want to. For e.g. if I decompile an apk and ...
user avatar
12 votes

Extract files from a bin firmware

Since version 0.50, binwalk has a -e option to extract files. Unfortunately, the manual doesn't tell you this, but if you invoke binwalk -version, it tells you -e, --extract=[file] ...
user avatar
12 votes

How do you can you disassemble and dump an entire binary?

You can use the special "'$' variables" $s to get the size of your binary, and pass it as an argument to the pd command to disassemble the whole file: [0x004048bf]> pd $s Do you want to print 188....
user avatar
  • 2,486
11 votes
Accepted

What Linux software can I use to explore entropy of a file?

You could use the #entropy command radare2. binwalk can calculate entropy, too. Radare2 From the manual page of Radare2: #[hash] Calculates the sha1, sha256, sha384, sha512, par, xor, ...
user avatar
  • 126
11 votes

Control flow graph reconstruction projects

Extracting control flow graph in JSON with radare2: $> python import r2pipe r2 = r2pipe.open("/bin/ls") r2.cmd("aaa") # See radare.today/posts/analysis-by-default/ cfg = r2.cmdj("agj") https://...
user avatar
  • 872
11 votes
Accepted

Extracting a NAND flash dump with OOB data

So, I have figured it out myself in the end. I'll try to describe the process. First, a bit of background on NAND: it is organized in pages which are grouped into blocks. You can read or write a ...
user avatar
  • 34.8k
10 votes
Accepted

in / out instructions - how should I treat this?

This is self-modifying code. The garbage instructions that you see will be altered dynamically, this way: seg000:00000000 mov edx, 61666A1Fh seg000:00000005 ...
user avatar
  • 4,511
10 votes
Accepted

What are some ways to pass raw bytes to a program via the Linux terminal?

Use echo -e and pipe to your program's input. Example: echo -e "\x41\x42\x43\x44" | <executable> Will write ABCD as input. edit: You can pass null-bytes
user avatar
  • 822
9 votes

Reverse engineering Perl-compatible regular-expressions

Googling for 0x50435245 gives several hits, for example here: /* Magic number to provide a small check against being handed junk. Also used to detect whether a pattern was compiled on a host of ...
user avatar
  • 34.8k
9 votes
Accepted

Get section's names and headers for a file using C++

I have extensive experience with parsing the PE on Windows, mainly for use in function interception. Here are the steps you should follow to achieve your goal. The first step is to find the base ...
user avatar
9 votes
Accepted

Protect data stored in binary

I would start with not have critical strings in memory in linear manner Instead each character can be offseted by some offset like by table mixing all the strings together. For example you got ...
user avatar
  • 1,374

Only top scored, non community-wiki answers of a minimum length are eligible