35
votes
Accepted
Approach to extract useful information from binary file
General Prerequisites
When analyzing binaries, it is important to be able to put what is observed into context. For example, how can CPU instructions be differentiated from data in a binary with a ...
- 6,948
34
votes
What is PLT/GOT?
Let me summarize the links given at https://reverseengineering.stackexchange.com/a/1993/12321 without going into serious disasembly analysis for now.
When the Linux kernel + dynamic linker is going ...
24
votes
Decoding an unknown image format with "DREK" signature (*.drk)
[Complete ReEdit3] further progress & shortening the text to fit the 30KB limit
First some input how I got here (for future readers trying to do the same for different format).
Image Data size
...
- 1,384
22
votes
Accepted
How to make radare2 work for a large binary?
It is not a good practice to run full analysis of your binary at the startup and it also isn't encourged by radare. Running aaa by default is a heavy action and absolutely not recommended or needed in ...
- 8,779
20
votes
Accepted
How to generate the call graph of a binary file?
You can use radare2 or one of the alternatives below to generate a full call-graph in dot format.
radare2 Installation
First of all, install radare2 from git repository:
$ git clone https://...
- 8,779
17
votes
What are some ways to pass raw bytes to a program via the Linux terminal?
If you need null bytes, you can write them to a file and use the file as input for the program, e.g.:
echo -e -n "\x00\xFF\xAB" > file.bin
program < file.bin
You can use also use xxd ...
- 35.5k
16
votes
Accepted
Remove code signature from a Mac binary
There are tools for that, as well as a codesign flag --remove-signature
First two should work the same. The codesign flag is undocumented and so YMMV (A user reported in a comment the codesign ...
- 11.6k
16
votes
Accepted
Import table vs Import Address Table
As general, I recommend reading the PE Format documentation on MSDN regarding the PE structure.
Import Table
The Import Table is actually called "Import Directory Table" and contains entries for ...
- 8,779
16
votes
Accepted
Difference between Main and Entry
Main is usually a programmer-defined entry point, while entry is defined by the compiler, it's doing many other operations such as libc initializations, heap allocation, and so on, and eventually, ...
- 1,788
15
votes
how can I diff two x86 binaries at assembly code level?
There are various great alternatives here. However, all of them seem to be unmaintained. The tool I recommend you is Diaphora https://github.com/joxeankoret/diaphora (Disclaimer: I'm the author). Is a ...
- 4,345
14
votes
Accepted
Why do reversers nowadays reverse engineer using decompilers and not disassemblers?
Although these terms are being used interchangeably, there is an intrinsic difference between disassembler and decompiler definitions traditionally. Let's first consider common steps involved in ...
- 1,547
12
votes
How do I reverse engineer .so files found in android APKs?
Use android-ndk, https://developer.android.com/ndk/downloads/index.html.
You can use the toolchains inside the ndk to perform the type of disassembling you want to. For e.g. if I decompile an apk and ...
- 121
12
votes
Extract files from a bin firmware
Since version 0.50, binwalk has a -e option to extract files. Unfortunately, the manual doesn't tell you this, but if you invoke binwalk -version, it tells you
-e, --extract=[file] ...
- 12.8k
12
votes
How do you can you disassemble and dump an entire binary?
You can use the special "'$' variables" $s to get the size of your binary, and pass it as an argument to the pd command to disassemble the whole file:
[0x004048bf]> pd $s
Do you want to print 188....
- 2,496
11
votes
Control flow graph reconstruction projects
Extracting control flow graph in JSON with radare2:
$> python
import r2pipe
r2 = r2pipe.open("/bin/ls")
r2.cmd("aaa") # See radare.today/posts/analysis-by-default/
cfg = r2.cmdj("agj")
https://...
- 870
11
votes
Accepted
Extracting a NAND flash dump with OOB data
So, I have figured it out myself in the end. I'll try to describe the process.
First, a bit of background on NAND: it is organized in pages which are grouped into blocks. You can read or write a ...
- 35.5k
11
votes
Accepted
How to print the value of register with Radare 2
Printing the registry values in radare2 is quite simple.
All registers
You can print all the General Purpose registers using dr:
[0x55bea3305070]> dr
rax = 0x55bea3305070
rbx = 0x00000000
rcx = ...
- 8,779
10
votes
Visualizing ELF binaries
BinView is a prototype for a tool for binary data visualization
GitHub repository
- 101
10
votes
Accepted
What are some ways to pass raw bytes to a program via the Linux terminal?
Use echo -e and pipe to your program's input.
Example:
echo -e "\x41\x42\x43\x44" | <executable>
Will write ABCD as input.
edit:
You can pass null-bytes
- 852
10
votes
What does 'test al, al' mean?
In x86 assembly, al is the least significant byte of eax register, which is typically used to return values from function calls.
The test al,al is a bitwise AND operation between al and itself.
If ...
- 852
9
votes
Accepted
Protect data stored in binary
I would start with not have critical strings in memory in linear manner
Instead each character can be offseted by some offset like by table mixing all the strings together. For example you got ...
- 1,384
9
votes
Accepted
Heap Chunk Structure Does Not Contain Previous Section Info
The diagram you linked to seems to be wrong. The size of the previous chunk is stored in the current chunk iff, the previous chunk is free.
This image is more appropriate of what an allocated heap ...
- 5,950
9
votes
Accepted
Correct way to understand local_ in ghidra disassembly
Since local variables are usually placed on the stack in x86 and esp register can change during function execution, it is more convenient to save the value of esp register on function entry and access ...
- 3,289
8
votes
Accepted
Extract files from a bin firmware
You can use the -D option to dd out sections based on signature.
For example, to extract out the ELF parts, do:
binwalk -D "elf 32-bit lsb shared object":.so image.bin
Note the lowercase signature ...
- 96
8
votes
Accepted
Understanding the loop disassembly
var_D8 is your int arr[50].
You can recognize it quickly solely by its name : 50 * sizeof(int) = 200 = 0xC8. The next variable on the stack is numb_of_elements which is positionned on -0x10 on the ...
- 578
8
votes
Accepted
Reverse engineer 4-bit CRC in LG IR packet
This seems to be a checksum, just as you state in your question, not a CRC as mentioned in the header.
Group the values into blocks of 4 bits, add them, ignore overflow (in these examples, ignore ...
- 12.8k
8
votes
Reverse Engineering a Firmware. Someone can help me?
Finding: NGA_FW_CURRENT.BIN is a compressed Videx microchip firmware image file.
Preliminary Remarks
There is conflicting background information given in the comments about the file alleged to be ...
- 6,948
8
votes
How to generate the call graph of a binary file?
You might want to give angr a try.
Load the binary. Suppose p is the angr Project instance.
Generate a CFG: cfg = p.analyses.CFG(show_progressbar=True).
Access/traverse the call graph (which is a ...
- 194
7
votes
Accepted
Parsing/Rescuing corrupted IDA database
I published some tools on github which can do just that: https://github.com/nlitsme/pyidbutil and https://github.com/nlitsme/idbutil.
The first is written in python, the second in C++, both have ...
- 1,809
7
votes
Accepted
Visual studio memory allocation reverse engineering
You may want to read up on assembly before attempting to reverse engineer.
esi and edi are pushed on the stack because the compiler thought this routine modifies them. (It is wrong because only edi ...
- 2,324
Only top scored, non community-wiki answers of a minimum length are eligible