New answers tagged binary-analysis
1
Looks like strings from the first few sections of a Linux ELF32 binary created using the GCC toolchain. I can't tell you which version of GCC though.
Your question should include the output of the following commands:
file [name of binary]
readelf -h [name of binary]
readelf -SW [name of binary]
objdump -dj .text [name of binary]
strings output on its own ...
2
I'll present the steps that I would perform in such a case. Note that they aren't necessarily the most efficient and reliable ones although they should work in many cases. I'm assuming that the binary you want to examine isn't packed and obfuscated.
Look for the imports. Sometimes the code you are looking for is just taken from external library. In this ...
0
I ended up using Intel PIN
Pretty useful.
0
So I'm still looking for a better understanding but I found that the GNU_RELRO points from 0x03de8-0x04000, which tells me that this is somehow connected to dynamic relocation sections, and running objdump -R gives me this
DYNAMIC RELOCATION RECORDS
OFFSET TYPE VALUE
0000000000003de8 R_X86_64_RELATIVE *ABS*+0x0000000000001130
...
3
This error message probably should be ignored. I found something on the radare2 github
"These ptrace (PT_ATTACH): Operation not permitted messages seem to
happen because of subsequent PT_ATTACH calls to the same pid, even
though it is already attached. This should be fixed, but it probably
shouldn't cause any major issues right now." ~thestr4ng3r
...
1
I mailed Nirsoft RouterPassView tool creator for about a month and he figured the way to decrypt it after so many tries ... and it wasn't the way that you mentioned in the article at all but it was in one of the mentioned files libcfmapi.so
and finally when he figured it out he said
It's from the strings I found, but I had to put them in different
...
Top 50 recent answers are included
