35
votes
Accepted
Approach to extract useful information from binary file
General Prerequisites
When analyzing binaries, it is important to be able to put what is observed into context. For example, how can CPU instructions be differentiated from data in a binary with a ...
- 7,078
35
votes
Objdump - How to output text (eg ASCII strings) alongside assembly code?
It is assumed here that Linux ELF32 binaries are being analyzed.
Code and data such as strings are stored in separate parts of ELF binaries.
To disassemble the parts containing code, use objdump -...
- 7,078
31
votes
Accepted
Managing inputs for payload injection?
Injecting payload and hexadecimal addresses through program inputs depends on the type of input you get. Here is a list of all the possible inputs and the way to do it with both a pure shell ...
- 18.9k
18
votes
Accepted
Remove code signature from a Mac binary
There are tools for that, as well as a codesign flag --remove-signature
First two should work the same. The codesign flag is undocumented and so YMMV (A user reported in a comment the codesign ...
- 11.7k
17
votes
What are some ways to pass raw bytes to a program via the Linux terminal?
If you need null bytes, you can write them to a file and use the file as input for the program, e.g.:
echo -e -n "\x00\xFF\xAB" > file.bin
program < file.bin
You can use also use xxd ...
- 36.4k
10
votes
Accepted
What are some ways to pass raw bytes to a program via the Linux terminal?
Use echo -e and pipe to your program's input.
Example:
echo -e "\x41\x42\x43\x44" | <executable>
Will write ABCD as input.
edit:
You can pass null-bytes
- 912
8
votes
Accepted
What is the "standard" approach to find loop in binary code?
The classic, compiler theoretic answer to this question is to build a control flow graph and then do a graph analysis to identify natural loops. I believe algorithms for this can be found in the ...
- 2,868
6
votes
Accepted
Unpack IpCam firmware - Binwalk extraction issue
Although my binwalk version extracted the files correctly to the system folder along with the zip files containing only the sysversion.txt, I shortly describe why you see only the sysversion.txt in ...
- 1,759
5
votes
Accepted
What are the side effects of setting the timestamp in the PE-header to 0?
Does this have any side-effects?
No, the Windows loader doesn't care about the timestamp in an EXE's PE header.
Are there compiler/linker flags to get this automatically?
No, Visual C++'s link....
- 20.7k
5
votes
Accepted
How can I get the shared libraries' function calls using angr
However I don't know how to get the function calls from the nodes
Are you saying you want to know which function a node belongs to, or which function a node is calling?
For the former, each block ...
- 194
5
votes
Accepted
What are the popular machine learning unsupervised approaches to learning binary data representations?
Inferring the structure of an unknown binary stream is a really difficult task, that I'm aware of only a few attempts at tackling:
Pulsar is an example project but I suspect it is not really mature.
...
- 11.7k
4
votes
Variable liveness analysis on binaries
I don't think that it is possible.
Let's assume the following C code:
int f1(int p1, int p2)
{
int l1, l2, l3;
/* some code */
l1 = l1 + l2; // here is our virtual address
return l1;
...
- 8,428
4
votes
Accepted
Reverse engineering binary file to find flag
Since this is a reversing challenge, I won't jump the gun right away and give you some tips which may help for this and future Challenges.
The check function (_Z5checkPc is a mangled name) looks like ...
- 2,896
4
votes
What's the best way of improving already compiled binary?
To me it seems the best way to approach this, if planned changes are considerable, is to instead create a DLL (you seem to be discussing windows, although this could work in most environments).
Then, ...
- 11.7k
4
votes
How can i start the RE process in radare2?(make changes to the registers)
It's not clear exactly what are you asking for, so I'll start from the basic.
Reverse Engineering 101
If you don't have previous experience with assembly or reverse engineering I'd suggest you to ...
- 8,919
4
votes
Accepted
How to change a string in a arm 32bit lsb executable binary using radare2?
Let's start from writing a simple Hello, World program and compile it.
beet:/tmp$ cat helloworld.c
#include <stdio.h>
int main()
{
printf("Hello, World!\n");
return 0;
}
beet:/tmp$ gcc ...
- 8,919
4
votes
Accepted
Reverse engineering checksum - LG 485 a/c protocol
did not check the second set
but your first set appears to be xorred by 0x55
0x55 ^ 0x18 == 0x4d (8 bit checksum )
edit
ok my guess was right here is a python script that prints the chksum
...
- 16.3k
4
votes
Wrong RVA values inside IMAGE_IMPORT_DESCRIPTOR
Unless you are loading a mapped PE file in your vector, you have to convert all RVAs to file offsets.
The pseodocode looks something like this:
func rva2offset(pe, rva):
for section in pe....
- 1,652
4
votes
OTOOL alternative for linux
I am in a similar position carrying out iOS related work on an Ubuntu host.
The suggestions to use objdump will not work unless it has been compiled specifically with support of Mach-O binaries which ...
- 167
4
votes
Accepted
Lipo alternate for linux
Here’s a port of Apple’s cctools to Linux, it should include lipo:
https://github.com/tpoechtrager/cctools-port
- 36.4k
4
votes
Accepted
Is the main function's name in the symbol table of C & C++ programs always 'main'? if not, how to find the name?
Since you mentioned ELF in the tag. WinMain, DllMain, etc should not be a concern for you. They're name conventions for Windows.
The main function is the first function executed for a C/C++ program. ...
- 1,124
4
votes
Accepted
Radare2 ptrace can not attach
This error message probably should be ignored. I found something on the radare2 github
"These ptrace (PT_ATTACH): Operation not permitted messages seem to
happen because of subsequent PT_ATTACH ...
- 191
3
votes
Accepted
3 questions on assembly - syntax, meaning, and equivalent in high level code (eg C++)
Note: this answer corresponds to the original question.
I am new to assembly as well so I can see where you are coming from. With that being said, there seem to be quite a few issues with the ...
- 7,078
3
votes
In angr, how to Load and Analyze a binary file that only contain a function instructions
Here are the steps I would normally do:
Load the binary in angr.
Build a CFG.
For each function you care about, first, get a reference of the function (func = cfg.functions[addr] or func = cfg....
- 194
3
votes
Accepted
Colorize and disassemble byte sequences with IDA Pro and IDAPython
You can easily do that using Sark:
# Get all the lines relevant to your bytes
for line in sark.lines(start=address, end=address + len(byte_sequence)):
# For each line, color it, and print the ...
- 1,567
3
votes
Accepted
Extracting firmware BIN file
Binwalk performed a good work in this firmware file, but found too much parts. It worth to know, that Binwalk identifies types based on magic IDs and some other properties. In a typical firmware the ...
- 1,759
3
votes
Accepted
Trying to identify a string in a strcmp instruction
You need to read the ARM instruction reference. movt is the "Move Top" instruction, which sets the top 16 bits of a register to the specified value without changing the low 16 bits.
In other words, ...
- 36.4k
3
votes
What's the best way of improving already compiled binary?
Exporting the file to ASM then re-compiling takes a very long time, is very complicated and should be only done if you have a decent active intelligent group. Believe me, I have done this. We reverse ...
- 773
3
votes
How to check proprietary firmware for GPL violation
Use binwalk.
The ability to analyze a firmware image and extract data from it is extremely useful. It can allow you to analyze an embedded device for bugs, vulnerabilities, or GPL violations ...
3
votes
obtaining string value from Unknown elf-x86-64 binary with gdb
If the executable is not compiled statically, I think the easiest way is to inject a shared object (.so) with LD_PRELOAD to hook/overload the function which prints it and display the address of the ...
- 1,124
Only top scored, non community-wiki answers of a minimum length are eligible