35 votes
Accepted

Approach to extract useful information from binary file

General Prerequisites When analyzing binaries, it is important to be able to put what is observed into context. For example, how can CPU instructions be differentiated from data in a binary with a ...
julian's user avatar
  • 7,138
35 votes

Objdump - How to output text (eg ASCII strings) alongside assembly code?

It is assumed here that Linux ELF32 binaries are being analyzed. Code and data such as strings are stored in separate parts of ELF binaries. To disassemble the parts containing code, use objdump -...
julian's user avatar
  • 7,138
31 votes
Accepted

Managing inputs for payload injection?

Injecting payload and hexadecimal addresses through program inputs depends on the type of input you get. Here is a list of all the possible inputs and the way to do it with both a pure shell ...
perror's user avatar
  • 19.1k
18 votes
Accepted

Remove code signature from a Mac binary

There are tools for that, as well as a codesign flag --remove-signature First two should work the same. The codesign flag is undocumented and so YMMV (A user reported in a comment the codesign ...
NirIzr's user avatar
  • 11.8k
18 votes

What are some ways to pass raw bytes to a program via the Linux terminal?

If you need null bytes, you can write them to a file and use the file as input for the program, e.g.: echo -e -n "\x00\xFF\xAB" > file.bin program < file.bin You can use also use xxd ...
Igor Skochinsky's user avatar
  • 36.6k
10 votes
Accepted

What are some ways to pass raw bytes to a program via the Linux terminal?

Use echo -e and pipe to your program's input. Example: echo -e "\x41\x42\x43\x44" | <executable> Will write ABCD as input. edit: You can pass null-bytes
Yotamz's user avatar
  • 1,217
8 votes
Accepted

What is the "standard" approach to find loop in binary code?

The classic, compiler theoretic answer to this question is to build a control flow graph and then do a graph analysis to identify natural loops. I believe algorithms for this can be found in the ...
Brendan Dolan-Gavitt's user avatar
5 votes
Accepted

What are the side effects of setting the timestamp in the PE-header to 0?

Does this have any side-effects? No, the Windows loader doesn't care about the timestamp in an EXE's PE header. Are there compiler/linker flags to get this automatically? No, Visual C++'s link....
Jason Geffner's user avatar
5 votes
Accepted

How can I get the shared libraries' function calls using angr

However I don't know how to get the function calls from the nodes Are you saying you want to know which function a node belongs to, or which function a node is calling? For the former, each block ...
Fish's user avatar
  • 194
5 votes
Accepted

What are the popular machine learning unsupervised approaches to learning binary data representations?

Inferring the structure of an unknown binary stream is a really difficult task, that I'm aware of only a few attempts at tackling: Pulsar is an example project but I suspect it is not really mature. ...
NirIzr's user avatar
  • 11.8k
5 votes

OTOOL alternative for linux

I am in a similar position carrying out iOS related work on an Ubuntu host. The suggestions to use objdump will not work unless it has been compiled specifically with support of Mach-O binaries which ...
Jon's user avatar
  • 177
4 votes

What's the best way of improving already compiled binary?

Exporting the file to ASM then re-compiling takes a very long time, is very complicated and should be only done if you have a decent active intelligent group. Believe me, I have done this. We reverse ...
LUser's user avatar
  • 783
4 votes

What's the best way of improving already compiled binary?

To me it seems the best way to approach this, if planned changes are considerable, is to instead create a DLL (you seem to be discussing windows, although this could work in most environments). Then, ...
NirIzr's user avatar
  • 11.8k
4 votes
Accepted

Reverse engineering binary file to find flag

Since this is a reversing challenge, I won't jump the gun right away and give you some tips which may help for this and future Challenges. The check function (_Z5checkPc is a mangled name) looks like ...
Nordwald's user avatar
  • 2,906
4 votes

How can i start the RE process in radare2?(make changes to the registers)

It's not clear exactly what are you asking for, so I'll start from the basic. Reverse Engineering 101 If you don't have previous experience with assembly or reverse engineering I'd suggest you to ...
Megabeets's user avatar
  • 8,989
4 votes
Accepted

How to change a string in a arm 32bit lsb executable binary using radare2?

Let's start from writing a simple Hello, World program and compile it. beet:/tmp$ cat helloworld.c #include <stdio.h> int main() { printf("Hello, World!\n"); return 0; } beet:/tmp$ gcc ...
Megabeets's user avatar
  • 8,989
4 votes
Accepted

Reverse engineering checksum - LG 485 a/c protocol

did not check the second set but your first set appears to be xorred by 0x55 0x55 ^ 0x18 == 0x4d (8 bit checksum ) edit ok my guess was right here is a python script that prints the chksum ...
blabb's user avatar
  • 16.4k
4 votes

Wrong RVA values inside IMAGE_IMPORT_DESCRIPTOR

Unless you are loading a mapped PE file in your vector, you have to convert all RVAs to file offsets. The pseodocode looks something like this: func rva2offset(pe, rva): for section in pe....
mrexodia's user avatar
  • 1,652
4 votes
Accepted

Lipo alternate for linux

Here’s a port of Apple’s cctools to Linux, it should include lipo: https://github.com/tpoechtrager/cctools-port
Igor Skochinsky's user avatar
  • 36.6k
4 votes
Accepted

Is the main function's name in the symbol table of C & C++ programs always 'main'? if not, how to find the name?

Since you mentioned ELF in the tag. WinMain, DllMain, etc should not be a concern for you. They're name conventions for Windows. The main function is the first function executed for a C/C++ program. ...
wisk's user avatar
  • 1,154
4 votes
Accepted

Radare2 ptrace can not attach

This error message probably should be ignored. I found something on the radare2 github "These ptrace (PT_ATTACH): Operation not permitted messages seem to happen because of subsequent PT_ATTACH ...
Michael Santos's user avatar
3 votes
Accepted

Trying to identify a string in a strcmp instruction

You need to read the ARM instruction reference. movt is the "Move Top" instruction, which sets the top 16 bits of a register to the specified value without changing the low 16 bits. In other words, ...
Igor Skochinsky's user avatar
  • 36.6k
3 votes
Accepted

3 questions on assembly - syntax, meaning, and equivalent in high level code (eg C++)

Note: this answer corresponds to the original question. I am new to assembly as well so I can see where you are coming from. With that being said, there seem to be quite a few issues with the ...
julian's user avatar
  • 7,138
3 votes

In angr, how to Load and Analyze a binary file that only contain a function instructions

Here are the steps I would normally do: Load the binary in angr. Build a CFG. For each function you care about, first, get a reference of the function (func = cfg.functions[addr] or func = cfg....
Fish's user avatar
  • 194
3 votes
Accepted

Extracting firmware BIN file

Binwalk performed a good work in this firmware file, but found too much parts. It worth to know, that Binwalk identifies types based on magic IDs and some other properties. In a typical firmware the ...
ebux's user avatar
  • 1,759
3 votes

How to check proprietary firmware for GPL violation

Use binwalk. The ability to analyze a firmware image and extract data from it is extremely useful. It can allow you to analyze an embedded device for bugs, vulnerabilities, or GPL violations ...
3 votes

obtaining string value from Unknown elf-x86-64 binary with gdb

If the executable is not compiled statically, I think the easiest way is to inject a shared object (.so) with LD_PRELOAD to hook/overload the function which prints it and display the address of the ...
wisk's user avatar
  • 1,154
3 votes
Accepted

Debug point not hit with radare2

Your breakpoint doesn't work as it is put in the part of the code that is not executed with the pass your provided. I'll try not to give too much hint so that you can still solve it by yourself. You ...
Paweł Łukasik's user avatar
3 votes
Accepted

rip adress not visible with dr command

rip = x64 eip = x86 dr shows eip in your case it is probably some demangled name (not sure why radare2 inserts the GLIBC part ) but if you strip the GLIBC part you can use iD Command to demangle ...
blabb's user avatar
  • 16.4k
3 votes

Extract a secret from an Android apk or .so file

If the API key is a string then just running strings would reveal it w/o grep as you do in your example. There might be some other strings but longer ones seems to stand out so it should be clearly ...
Paweł Łukasik's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible