Hot answers tagged

35 votes

Objdump - How to output text (eg ASCII strings) alongside assembly code?

It is assumed here that Linux ELF32 binaries are being analyzed. Code and data such as strings are stored in separate parts of ELF binaries. To disassemble the parts containing code, use objdump -...
user avatar
  • 6,819
32 votes
Accepted

Approach to extract useful information from binary file

General Prerequisites When analyzing binaries, it is important to be able to put what is observed into context. For example, how can CPU instructions be differentiated from data in a binary with a ...
user avatar
  • 6,819
24 votes
Accepted

Managing inputs for payload injection?

Injecting payload and hexadecimal addresses through program inputs depends on the type of input you get. Here is a list of all the possible inputs and the way to do it with both a pure shell ...
user avatar
  • 18k
17 votes

What are some ways to pass raw bytes to a program via the Linux terminal?

If you need null bytes, you can write them to a file and use the file as input for the program, e.g.: echo -e -n "\x00\xFF\xAB" > file.bin program < file.bin You can use also use xxd ...
user avatar
  • 34.6k
15 votes
Accepted

Remove code signature from a Mac binary

There are tools for that, as well as a codesign flag --remove-signature First two should work the same. The codesign flag is undocumented and so YMMV (A user reported in a comment the codesign ...
user avatar
  • 11.3k
10 votes
Accepted

What are some ways to pass raw bytes to a program via the Linux terminal?

Use echo -e and pipe to your program's input. Example: echo -e "\x41\x42\x43\x44" | <executable> Will write ABCD as input. edit: You can pass null-bytes
user avatar
  • 822
9 votes

How to extract functions from one executable to include/link in another

Assume you have some unknown object file. The source code of it was #include <stdio.h> #include <string.h> #define NCHAR 26 void setkey(int i); char *encrypt(char *s); char keybuf[...
user avatar
7 votes
Accepted

Why are PUSHF and POPF so slow?

Clever (some would say incomprehensible) misuse of x86 features could do this for you. The loop instruction will decrement the ecx register, jump if it's nonzero, and not modify flags. You can use ...
user avatar
7 votes

Windows boot process doesn't make sense!

(I'll assume you're talking about the boot process using legacy BIOS as UEFI situation is different) The boot manager is not a PE, or, rather, not just a PE. It starts with 16-bit realmode part. You ...
user avatar
  • 34.6k
7 votes
Accepted

What is the "standard" approach to find loop in binary code?

The classic, compiler theoretic answer to this question is to build a control flow graph and then do a graph analysis to identify natural loops. I believe algorithms for this can be found in the ...
user avatar
6 votes

Date and time data extraction from a hex dump

the 64 bit value at offset 5 is the number of microseconds since the year 0: Use this perl script to verify: use POSIX; while (<DATA>) { if (/(.*\S)\s+->\s+(.*\S)/) { my ($hex, $...
user avatar
6 votes

How do the internals of a Windows update security patch work?

I just downloaded the KB2977629 patch file (IE11-Windows6.1-KB2977629-x64.MSU). It looks like the information about which file corresponds to what is inside the _manifest_.cix.xml file (there is a ...
user avatar
  • 165
6 votes
Accepted

How to find the size of an array in binary?

There's no easy way to do this, C doesn't have a concept of array sizes (at execute time), so the size isn't stored anywhere. You'll have to read the assembly code and (try to) understand it. Take ...
user avatar
6 votes
Accepted

Computing subtracted stack space for a function manually

Older compilers made space for function parameters on the stack by pushing them, and popping from the stack after the function call; newer compilers optimize this. For example, while a function gets ...
user avatar
6 votes
Accepted

Unpack IpCam firmware - Binwalk extraction issue

Although my binwalk version extracted the files correctly to the system folder along with the zip files containing only the sysversion.txt, I shortly describe why you see only the sysversion.txt in ...
user avatar
  • 1,731
5 votes

Reverse Engineering a Binary to reset a BIOS password

As a tool I would recommend radare2 for this task. And if you never done something like this before this is probably the best tutorial to get you started with. Just be in mind its not gonna be a ...
user avatar
5 votes
Accepted

What are the side effects of setting the timestamp in the PE-header to 0?

Does this have any side-effects? No, the Windows loader doesn't care about the timestamp in an EXE's PE header. Are there compiler/linker flags to get this automatically? No, Visual C++'s link....
user avatar
5 votes
Accepted

What are the popular machine learning unsupervised approaches to learning binary data representations?

Inferring the structure of an unknown binary stream is a really difficult task, that I'm aware of only a few attempts at tackling: Pulsar is an example project but I suspect it is not really mature. ...
user avatar
  • 11.3k
4 votes
Accepted

Decoding binary - basics

Converted to binary with 010 Editor, extracted the strings with Strings, and used some clever regex work with Notepad++ to remove some obvious bad strings. Results below. free premium shuffle all ...
user avatar
4 votes

Variable liveness analysis on binaries

I don't think that it is possible. Let's assume the following C code: int f1(int p1, int p2) { int l1, l2, l3; /* some code */ l1 = l1 + l2; // here is our virtual address return l1; ...
user avatar
  • 7,700
4 votes
Accepted

Reverse engineering binary file to find flag

Since this is a reversing challenge, I won't jump the gun right away and give you some tips which may help for this and future Challenges. The check function (_Z5checkPc is a mangled name) looks like ...
user avatar
  • 2,806
4 votes

What's the best way of improving already compiled binary?

To me it seems the best way to approach this, if planned changes are considerable, is to instead create a DLL (you seem to be discussing windows, although this could work in most environments). Then, ...
user avatar
  • 11.3k
4 votes
Accepted

How can I get the shared libraries' function calls using angr

However I don't know how to get the function calls from the nodes Are you saying you want to know which function a node belongs to, or which function a node is calling? For the former, each block ...
user avatar
  • 184
4 votes

How can i start the RE process in radare2?(make changes to the registers)

It's not clear exactly what are you asking for, so I'll start from the basic. Reverse Engineering 101 If you don't have previous experience with assembly or reverse engineering I'd suggest you to ...
user avatar
  • 8,579
4 votes
Accepted

How to change a string in a arm 32bit lsb executable binary using radare2?

Let's start from writing a simple Hello, World program and compile it. beet:/tmp$ cat helloworld.c #include <stdio.h> int main() { printf("Hello, World!\n"); return 0; } beet:/tmp$ gcc ...
user avatar
  • 8,579
4 votes
Accepted

Reverse engineering checksum - LG 485 a/c protocol

did not check the second set but your first set appears to be xorred by 0x55 0x55 ^ 0x18 == 0x4d (8 bit checksum ) edit ok my guess was right here is a python script that prints the chksum ...
user avatar
  • 14.8k
4 votes

Wrong RVA values inside IMAGE_IMPORT_DESCRIPTOR

Unless you are loading a mapped PE file in your vector, you have to convert all RVAs to file offsets. The pseodocode looks something like this: func rva2offset(pe, rva): for section in pe....
user avatar
  • 1,602
4 votes
Accepted

Is the main function's name in the symbol table of C & C++ programs always 'main'? if not, how to find the name?

Since you mentioned ELF in the tag. WinMain, DllMain, etc should not be a concern for you. They're name conventions for Windows. The main function is the first function executed for a C/C++ program. ...
user avatar
  • 1,074
4 votes
Accepted

Radare2 ptrace can not attach

This error message probably should be ignored. I found something on the radare2 github "These ptrace (PT_ATTACH): Operation not permitted messages seem to happen because of subsequent PT_ATTACH ...
user avatar
3 votes

Decoding binary - basics

One of the close reasons on Reverse Engineering is: Questions asking for help reverse-engineering a specific system are off-topic unless they demonstrate an understanding of the concepts involved ...
user avatar
  • 2,274

Only top scored, non community-wiki answers of a minimum length are eligible