38
votes
What is PLT/GOT?
Let me summarize the links given at https://reverseengineering.stackexchange.com/a/1993/12321 without going into serious disasembly analysis for now.
When the Linux kernel + dynamic linker is going ...
35
votes
Accepted
Approach to extract useful information from binary file
General Prerequisites
When analyzing binaries, it is important to be able to put what is observed into context. For example, how can CPU instructions be differentiated from data in a binary with a ...
- 7,078
24
votes
Decoding an unknown image format with "DREK" signature (*.drk)
[Complete ReEdit3] further progress & shortening the text to fit the 30KB limit
First some input how I got here (for future readers trying to do the same for different format).
Image Data size
...
- 1,384
24
votes
Accepted
How to make radare2 work for a large binary?
It is not a good practice to run full analysis of your binary at the startup and it also isn't encourged by radare. Running aaa by default is a heavy action and absolutely not recommended or needed in ...
- 8,919
21
votes
Accepted
How to generate the call graph of a binary file?
You can use radare2 or one of the alternatives below to generate a full call-graph in dot format.
radare2 Installation
First of all, install radare2 from git repository:
$ git clone https://...
- 8,919
18
votes
Accepted
Remove code signature from a Mac binary
There are tools for that, as well as a codesign flag --remove-signature
First two should work the same. The codesign flag is undocumented and so YMMV (A user reported in a comment the codesign ...
- 11.7k
17
votes
Accepted
Import table vs Import Address Table
As general, I recommend reading the PE Format documentation on MSDN regarding the PE structure.
Import Table
The Import Table is actually called "Import Directory Table" and contains entries for ...
- 8,919
17
votes
What are some ways to pass raw bytes to a program via the Linux terminal?
If you need null bytes, you can write them to a file and use the file as input for the program, e.g.:
echo -e -n "\x00\xFF\xAB" > file.bin
program < file.bin
You can use also use xxd ...
- 36.4k
16
votes
Accepted
Difference between Main and Entry
Main is usually a programmer-defined entry point, while entry is defined by the compiler, it's doing many other operations such as libc initializations, heap allocation, and so on, and eventually, ...
- 1,848
14
votes
Accepted
Why do reversers nowadays reverse engineer using decompilers and not disassemblers?
Although these terms are being used interchangeably, there is an intrinsic difference between disassembler and decompiler definitions traditionally. Let's first consider common steps involved in ...
- 1,797
12
votes
How do I reverse-engineer .so files found in Android APKs?
Use android-ndk, https://developer.android.com/ndk/downloads/index.html.
You can use the toolchains inside the ndk to perform the type of disassembling you want to. For e.g. if I decompile an apk and ...
- 121
11
votes
Control flow graph reconstruction projects
Extracting control flow graph in JSON with radare2:
$> python
import r2pipe
r2 = r2pipe.open("/bin/ls")
r2.cmd("aaa") # See radare.today/posts/analysis-by-default/
cfg = r2.cmdj("agj")
https://...
- 880
11
votes
Accepted
Extracting a NAND flash dump with OOB data
So, I have figured it out myself in the end. I'll try to describe the process.
First, a bit of background on NAND: it is organized in pages which are grouped into blocks. You can read or write a ...
- 36.4k
11
votes
Accepted
How to print the value of register with Radare 2
Printing the registry values in radare2 is quite simple.
All registers
You can print all the General Purpose registers using dr:
[0x55bea3305070]> dr
rax = 0x55bea3305070
rbx = 0x00000000
rcx = ...
- 8,919
11
votes
What does 'test al, al' mean?
In x86 assembly, al is the least significant byte of eax register, which is typically used to return values from function calls.
The test al,al is a bitwise AND operation between al and itself.
If ...
- 892
10
votes
Accepted
What are some ways to pass raw bytes to a program via the Linux terminal?
Use echo -e and pipe to your program's input.
Example:
echo -e "\x41\x42\x43\x44" | <executable>
Will write ABCD as input.
edit:
You can pass null-bytes
- 892
9
votes
Import table vs Import Address Table
First, beside “yours” two tables, I introduce a third one, the Import Lookup Table.
Side by side with the Import Address Table, these two tables look like in this simplified picture:
This picture ...
- 1,120
9
votes
Accepted
Heap Chunk Structure Does Not Contain Previous Section Info
The diagram you linked to seems to be wrong. The size of the previous chunk is stored in the current chunk iff, the previous chunk is free.
This image is more appropriate of what an allocated heap ...
- 6,040
9
votes
Accepted
Correct way to understand local_ in ghidra disassembly
Since local variables are usually placed on the stack in x86 and esp register can change during function execution, it is more convenient to save the value of esp register on function entry and access ...
- 3,369
8
votes
Accepted
What is the "standard" approach to find loop in binary code?
The classic, compiler theoretic answer to this question is to build a control flow graph and then do a graph analysis to identify natural loops. I believe algorithms for this can be found in the ...
- 2,868
8
votes
Reverse Engineering a Firmware. Someone can help me?
Finding: NGA_FW_CURRENT.BIN is a compressed Videx microchip firmware image file.
Preliminary Remarks
There is conflicting background information given in the comments about the file alleged to be ...
- 7,078
8
votes
How to generate the call graph of a binary file?
You might want to give angr a try.
Load the binary. Suppose p is the angr Project instance.
Generate a CFG: cfg = p.analyses.CFG(show_progressbar=True).
Access/traverse the call graph (which is a ...
- 194
7
votes
How to identify the structure of this specific data file?
It's certainly not a well known format. A quick glance at the file with a hex viewer shows that it mainly consists of records that all have similar, but not identical, size and layout; the very end of ...
- 12.9k
7
votes
Accepted
Parsing/Rescuing corrupted IDA database
I published some tools on github which can do just that: https://github.com/nlitsme/pyidbutil and https://github.com/nlitsme/idbutil.
The first is written in python, the second in C++, both have ...
- 1,829
7
votes
Accepted
Control flow graph reconstruction projects
For now, the most efficient approaches in practice seems to follow the principle of symbolic execution. This technique, originally developed to automatically build-up a set of test cases based on a ...
- 18.9k
7
votes
Accepted
Simple carving of zip file using binwalk
Binwalk produces multiple large files, because the zlib header does not contain any information about the size of the compressed data.
The following steps should be performed to extract the zip files:...
- 1,759
7
votes
Accepted
Running a binary identified as an ARM excutable by binwalk --disasm
Obstacles
One of the difficulties associated with analyzing firmware is that firmware binaries do not usually have a standard format and do not segregate code and data in a standard manner like ELF ...
- 7,078
7
votes
Accepted
reversing stripped & statically linked binary with radare2
Seems like lscan is written to work with IDA. However, lscan is based on FLIRT signature files which can be also read by radare2 (See the Zignatures section of this answer). There are several things ...
- 8,919
7
votes
Accepted
Flare-ON#3: Problem understanding some parts in the program
Should not the location be empty or have some other values than assembly instructions...?
The answer is "no". As the author stated in the write-up, this binary is self-modifying:
At this stage you ...
- 8,919
7
votes
Accepted
Radare2 Find command line arguments and location in stack
radare2 currently doesn't flags argv and argc. Yet, it shouldn't be something complicated to implement.
Although these arguments are not flagged by radare2, they can be easily be visible to us by ...
- 8,919
Only top scored, non community-wiki answers of a minimum length are eligible