99
votes
Accepted
How do I reverse engineer .so files found in android APKs?
The .so file is a compiled library, in most cases from C or C++ source code. .so stands for Shared Object, it doesn't have anything to do with obfusation, it just means someone wrote parts of the app ...
- 12.7k
33
votes
Accepted
Approach to extract useful information from binary file
General Prerequisites
When analyzing binaries, it is important to be able to put what is observed into context. For example, how can CPU instructions be differentiated from data in a binary with a ...
- 6,859
30
votes
What is PLT/GOT?
Let me summarize the links given at https://reverseengineering.stackexchange.com/a/1993/12321 without going into serious disasembly analysis for now.
When the Linux kernel + dynamic linker is going ...
25
votes
How do I reverse engineer .so files found in android APKs?
Besides Guntram's suggestions, check out the retargetable decompiler aka retdec. It can decompile the binary to Python or C code. At least for me, it reads easier than pure assembly (and it works for ...
- 351
24
votes
Decoding an unknown image format with "DREK" signature (*.drk)
[Complete ReEdit3] further progress & shortening the text to fit the 30KB limit
First some input how I got here (for future readers trying to do the same for different format).
Image Data size
...
- 1,374
22
votes
Accepted
How to make radare2 work for a large binary?
It is not a good practice to run full analysis of your binary at the startup and it also isn't encourged by radare. Running aaa by default is a heavy action and absolutely not recommended or needed in ...
- 8,639
21
votes
Accepted
Why I can not directly get the content of `.bss` section?
The .bss has no content. It's simply a tip to the loader to preallocate some space when starting the program. It will be all 0s at the execution and won't hold any useful information until the program ...
- 261
20
votes
Code Coverage - Fuzzing
Correct disassembly of an executable is known to be undecidable in the general case (this problem can obviously be related to the famous halting problem of a Turing machine).
So, extracting all the ...
- 18.1k
20
votes
Accepted
How to generate the call graph of a binary file?
You can use radare2 or one of the alternatives below to generate a full call-graph in dot format.
radare2 Installation
First of all, install radare2 from git repository:
$ git clone https://...
- 8,639
17
votes
What are some ways to pass raw bytes to a program via the Linux terminal?
If you need null bytes, you can write them to a file and use the file as input for the program, e.g.:
echo -e -n "\x00\xFF\xAB" > file.bin
program < file.bin
You can use also use xxd ...
- 34.8k
16
votes
Accepted
Remove code signature from a Mac binary
There are tools for that, as well as a codesign flag --remove-signature
First two should work the same. The codesign flag is undocumented and so YMMV (A user reported in a comment the codesign ...
- 11.4k
16
votes
Accepted
Import table vs Import Address Table
As general, I recommend reading the PE Format documentation on MSDN regarding the PE structure.
Import Table
The Import Table is actually called "Import Directory Table" and contains entries for ...
- 8,639
16
votes
Accepted
Difference between Main and Entry
Main is usually a programmer-defined entry point, while entry is defined by the compiler, it's doing many other operations such as libc initializations, heap allocation, and so on, and eventually, ...
- 1,748
15
votes
how can I diff two x86 binaries at assembly code level?
There are various great alternatives here. However, all of them seem to be unmaintained. The tool I recommend you is Diaphora https://github.com/joxeankoret/diaphora (Disclaimer: I'm the author). Is a ...
- 4,315
15
votes
Accepted
What's the difference between a disassembler, debugger and decompiler?
These terms are currently defined on this site as follows:
Disassembler:
A disassembler is a software tool which transforms machine code into a
human readable mnemonic representation called ...
- 20.4k
14
votes
Why are GOT and PLT still present in Linux static stripped binaries?
There are a plethora of things programmers do not know about how ELF binaries work internally. And, unfortunately, there's almost no solid references apart from two or three which broadly cover the ...
- 2,603
14
votes
How do I reverse engineer .so files found in android APKs?
You can also try a dynamic approach by hooking APIs and observing arguments and return values. This will allow you to look at data going into crypto APIs, which may help a lot when dealing with ...
14
votes
Accepted
Finding the actual Thumb code in firmware
I downloaded the archive you referenced and the first thing I noticed was that the firmware files are very heavy in the 0x80 - 0xff range. Inverting each byte resulted in a much nicer byte ...
- 501
13
votes
Accepted
Why do reversers nowadays reverse engineer using decompilers and not disassemblers?
Although these terms are being used interchangeably, there is an intrinsic difference between disassembler and decompiler definitions traditionally. Let's first consider common steps involved in ...
- 1,437
12
votes
How do I reverse engineer .so files found in android APKs?
Use android-ndk, https://developer.android.com/ndk/downloads/index.html.
You can use the toolchains inside the ndk to perform the type of disassembling you want to. For e.g. if I decompile an apk and ...
- 121
12
votes
Extract files from a bin firmware
Since version 0.50, binwalk has a -e option to extract files. Unfortunately, the manual doesn't tell you this, but if you invoke binwalk -version, it tells you
-e, --extract=[file] ...
- 12.7k
12
votes
How do you can you disassemble and dump an entire binary?
You can use the special "'$' variables" $s to get the size of your binary, and pass it as an argument to the pd command to disassemble the whole file:
[0x004048bf]> pd $s
Do you want to print 188....
- 2,486
11
votes
Accepted
What Linux software can I use to explore entropy of a file?
You could use the #entropy command radare2. binwalk can calculate entropy, too.
Radare2
From the manual page of Radare2:
#[hash] Calculates the sha1, sha256, sha384, sha512, par, xor,
...
- 126
11
votes
Control flow graph reconstruction projects
Extracting control flow graph in JSON with radare2:
$> python
import r2pipe
r2 = r2pipe.open("/bin/ls")
r2.cmd("aaa") # See radare.today/posts/analysis-by-default/
cfg = r2.cmdj("agj")
https://...
- 872
11
votes
Accepted
Extracting a NAND flash dump with OOB data
So, I have figured it out myself in the end. I'll try to describe the process.
First, a bit of background on NAND: it is organized in pages which are grouped into blocks. You can read or write a ...
- 34.8k
10
votes
Accepted
in / out instructions - how should I treat this?
This is self-modifying code. The garbage instructions that you see will be altered dynamically, this way:
seg000:00000000 mov edx, 61666A1Fh
seg000:00000005 ...
- 4,511
10
votes
Accepted
What are some ways to pass raw bytes to a program via the Linux terminal?
Use echo -e and pipe to your program's input.
Example:
echo -e "\x41\x42\x43\x44" | <executable>
Will write ABCD as input.
edit:
You can pass null-bytes
- 822
9
votes
Reverse engineering Perl-compatible regular-expressions
Googling for 0x50435245 gives several hits, for example here:
/* Magic number to provide a small check against being handed junk. Also used
to detect whether a pattern was compiled on a host of ...
- 34.8k
9
votes
Accepted
Get section's names and headers for a file using C++
I have extensive experience with parsing the PE on Windows, mainly for use in function interception. Here are the steps you should follow to achieve your goal.
The first step is to find the base ...
- 368
9
votes
Accepted
Protect data stored in binary
I would start with not have critical strings in memory in linear manner
Instead each character can be offseted by some offset like by table mixing all the strings together. For example you got ...
- 1,374
Only top scored, non community-wiki answers of a minimum length are eligible