Hot answers tagged

24

It is assumed here that Linux ELF32 binaries are being analyzed. Code and data such as strings are stored in separate parts of ELF binaries. To disassemble the parts containing code, use objdump -dj .text <binary_name>. To examine hard-coded string data, use readelf -x .rodata <binary_name> Instructions and Data are located in separate areas ...


24

General Prerequisites When analyzing binaries, it is important to be able to put what is observed into context. For example, how can CPU instructions be differentiated from data in a binary with a non-standard format? This requires some background knowledge of computer systems in general. I would argue that before any attempt at reverse engineering firmware ...


12

Injecting payload and hexadecimal addresses through program inputs depends on the type of input you get. Here is a list of all the possible inputs and the way to do it with both a pure shell environment and from within gdb. Getting inputs from char *argv[] In this case, the arguments are read from the initial command line, so the most convenient thing is: ...


9

There are tools for that, as well as a codesign flag --remove-signature First two should work the same. The codesign flag is undocumented and so YMMV (A user reported in a comment the codesign produced a corrupt executable). You should use any of them with caution and backup the application before using them.


8

Assume you have some unknown object file. The source code of it was #include <stdio.h> #include <string.h> #define NCHAR 26 void setkey(int i); char *encrypt(char *s); char keybuf[NCHAR]; char codepoint(char c); int main(void) { char *secret; setkey(5); secret=strdup("Hello World"); printf("%s\n", encrypt(secret)); } void ...


7

(I'll assume you're talking about the boot process using legacy BIOS as UEFI situation is different) The boot manager is not a PE, or, rather, not just a PE. It starts with 16-bit realmode part. You can check it yourself by looking at the file. 0000000000: E9 D5 01 EB 04 90 00 00 │ 00 52 8B C3 0E 07 66 33 0000000010: DB BA 01 00 E8 34 00 E9 │ 51 01 2E 88 ...


7

Clever (some would say incomprehensible) misuse of x86 features could do this for you. The loop instruction will decrement the ecx register, jump if it's nonzero, and not modify flags. You can use this as a jump forward instruction as well, like this: BB23: push %ecx movl index, %ecx movl $0x17, buf-4(,%ecx,4) loop ...


7

The classic, compiler theoretic answer to this question is to build a control flow graph and then do a graph analysis to identify natural loops. I believe algorithms for this can be found in the Dragon Book, and a summary is given in these slides: http://www.cs.cmu.edu/afs/cs/academic/class/15745-s03/public/lectures/L7_handouts.pdf You can also see how ...


6

Older compilers made space for function parameters on the stack by pushing them, and popping from the stack after the function call; newer compilers optimize this. For example, while a function gets executed, the stack changed like this: start calling after before scanf after scanf printf printf ...


5

Although my binwalk version extracted the files correctly to the system folder along with the zip files containing only the sysversion.txt, I shortly describe why you see only the sysversion.txt in the archive files. It is because the firmware file contain multiple PKZIP archives and the binwalk does not know the exact size of these files. So, it can ...


5

There's no easy way to do this, C doesn't have a concept of array sizes (at execute time), so the size isn't stored anywhere. You'll have to read the assembly code and (try to) understand it. Take the following program extern void *malloc(int); extern char *strcpy(char *dst, char *src); char firstname[80]; char lastname[80]; int main(void) { int ...


5

I just downloaded the KB2977629 patch file (IE11-Windows6.1-KB2977629-x64.MSU). It looks like the information about which file corresponds to what is inside the _manifest_.cix.xml file (there is a single, very long, line inside). You have for example: <File id="214" name="amd64_microsoft-windows-s..-downlevel.binaries_31bf3856ad364e35_6.3.9600....


5

the 64 bit value at offset 5 is the number of microseconds since the year 0: Use this perl script to verify: use POSIX; while (<DATA>) { if (/(.*\S)\s+->\s+(.*\S)/) { my ($hex, $date)= ($1,$2); # convert date to unix timestamp $date =~ s/x/0/g; my @f= reverse split /[. ]/, $date; $f[4]--; # correct ...


5

Does this have any side-effects? No, the Windows loader doesn't care about the timestamp in an EXE's PE header. Are there compiler/linker flags to get this automatically? No, Visual C++'s link.exe does not have a command line switch for specifying the timestamp to use. (And Visual C++'s cl.exe doesn't apply since the PE timestamp is a linking timestamp, ...


4

As a tool I would recommend radare2 for this task. And if you never done something like this before this is probably the best tutorial to get you started with. Just be in mind its not gonna be a quick and dirty job, might take you a while.


4

I don't think that it is possible. Let's assume the following C code: int f1(int p1, int p2) { int l1, l2, l3; /* some code */ l1 = l1 + l2; // here is our virtual address return l1; } int f2(int p3, int p4) { int l4, l5, l6; return f1(p3, p4); } int f3(int p5, p6) { int l7, l8; return f2(p5, p6) + f1(p6, p5); } Obviously ...


4

To me it seems the best way to approach this, if planned changes are considerable, is to instead create a DLL (you seem to be discussing windows, although this could work in most environments). Then, you'll only need to patch calls to your modified or new functionality functions. Either by first editing the Import Table or by dynamically loading your DLL ...


4

It's not clear exactly what are you asking for, so I'll start from the basic. Reverse Engineering 101 If you don't have previous experience with assembly or reverse engineering I'd suggest you to start from there since you need to know the techniques before you should get to know the tools. You can start learning from any source you find suitable for you. ...


4

did not check the second set but your first set appears to be xorred by 0x55 0x55 ^ 0x18 == 0x4d (8 bit checksum ) edit ok my guess was right here is a python script that prints the chksum using the data copy pasted to a text file infile = open("timepass.txt" , "r") while True: line = infile.readline() a = line.split(",") sum = 0x0; ...


4

Inferring the structure of an unknown binary stream is a really difficult task, that I'm aware of only a few attempts at tackling: Pulsar is an example project but I suspect it is not really mature. Netzob is another project, and it seems more complete. Radamsa is a third project. looks more complete than Pulsar and more actively maintained than both. I do ...


4

Unless you are loading a mapped PE file in your vector, you have to convert all RVAs to file offsets. The pseodocode looks something like this: func rva2offset(pe, rva): for section in pe.sections: if rva >= section.rva and rva < section.rva + section.size: return section.fileoffset + (rva - section.rva) return nil The ...


3

You can easily do that using Sark: # Get all the lines relevant to your bytes for line in sark.lines(start=address, end=address + len(byte_sequence)): # For each line, color it, and print the disasm and the instruction length line.color = 0x123456 print 'Line Size: {}\nLine Disasm: {}'.format(line.size, line.disasm) You might need to add ...


3

If you look at lib/Target/X86/X86InstrInfo.cpp in the LLVM source code you can see that they prefer the LAHF and SAHF instructions to PUSHF and POPF for speed reasons. These instructions don't deal with the overflow flag OF so this must be handled with separately. alt_pushf: seto %al ; save OF to AL lahf ...


3

One of the close reasons on Reverse Engineering is: Questions asking for help reverse-engineering a specific system are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem. ... and you don't appear to understand the "concepts involved". This is because I asked for a "binary", and you posted ...


3

Converted to binary with 010 Editor, extracted the strings with Strings, and used some clever regex work with Notepad++ to remove some obvious bad strings. Results below. free premium shuffle all commercial everywhere Fetty Wap Wiz Khalifa SKE Charlie Puth T-Wayne Major Lazer DJ Snake DJ Snake Jason Derulo Jack Skrillex Cbc Diplo Justin Bieber Walk the ...


3

Yes, 010 Editor allows you to do this: Even though I wrote ASCII text in binary above, you could instead use the same interface to write machine code bit-by-bit.


3

The POST firmware is raw ARM big-endian code. Load address is 0x02020000. There doesn't seem to be any embedded sub-files or filesystems. The EOS firmware has a few ARM instructions at the beginning, and then some compressed or encrypted data. You'll probably need to analyze the POST firmware to figure out how to decompress it.


3

Since a dylib file is just going to be a Mach-O file, you're going to need to understand the header format, which is laid out pretty well in the code itself. You can take a look at the Mach-O parsing functions on Apple's site http://www.opensource.apple.com/source/xar/xar-45/xar/lib/macho.c What you're seeing is that FAT Header part of the Mach-O file, ...


3

Binwalk performed a good work in this firmware file, but found too much parts. It worth to know, that Binwalk identifies types based on magic IDs and some other properties. In a typical firmware the parts are stored in compressed and may be in encrypted form. It means, there are some high entropy parts, which possible will not contain any known file type ...


3

Here are the steps I would normally do: Load the binary in angr. Build a CFG. For each function you care about, first, get a reference of the function (func = cfg.functions[addr] or func = cfg.functions.function(name=the_name)), and then traverse the graph (func.graph or func.transition_graph).


Only top voted, non community-wiki answers of a minimum length are eligible