38
votes
What is PLT/GOT?
Let me summarize the links given at https://reverseengineering.stackexchange.com/a/1993/12321 without going into serious disasembly analysis for now.
When the Linux kernel + dynamic linker is going ...
21
votes
Accepted
How to generate the call graph of a binary file?
You can use radare2 or one of the alternatives below to generate a full call-graph in dot format.
radare2 Installation
First of all, install radare2 from git repository:
$ git clone https://...
- 8,919
15
votes
Accepted
Writing ELF headers in Radare?
Yes, obviously you can. radare2 has built-in features to handle binary headers. This including reading, parsing and modifying the headers of the binary. And this is not different for elf or pe files, ...
- 8,919
11
votes
Set a breakpoint on GDB entry point for stripped PIE binaries without disabling ASLR
Starting with GDB 8.1, there's a special command for this: starti. Example GDB session:
$ gdb /bin/true
Reading symbols from /bin/true...(no debugging symbols found)...done.
(gdb) starti
Starting ...
- 283
10
votes
Accepted
Understanding gdb output
Seems like relocation. If you look at the addresses in your first listing, you will notice that these addresses are unusually low. That's probably because gdb displays file offsets there (although I ...
- 2,896
9
votes
Accepted
Find function in a stripped dynamic ELF library
There're two broad ways in which you can declare JNI functions.
The first is the more obvious way in which the JNI function has to follow a specific naming convention like JNIEXPORT void JNICALL ...
- 6,040
8
votes
Why are symbols with local binding present in the symbol table of my ELF files?
Symbol Binding and Symbol Visibility
What are they needed for?
There must be a way for the link editor (ld) to determine the scope of a symbol during link-time. In other words, symbol binding ...
- 7,078
8
votes
How to generate the call graph of a binary file?
You might want to give angr a try.
Load the binary. Suppose p is the angr Project instance.
Generate a CFG: cfg = p.analyses.CFG(show_progressbar=True).
Access/traverse the call graph (which is a ...
- 194
8
votes
Accepted
ELF x86 - Why is return address pushed twice?
It was present on the stack before and esp, 0xfffffff0 instruction that aligns the stack to 16 bytes. This instruction doesn't erase the data that was previously at esp (so ecx-4 still points to the ...
- 3,369
7
votes
Reverse engineering a golang binary file
I'm afraid your intentions to find memory usage may need both static and dynamic analysis. Run-time events can cause more or less memory usage. I will write my general findings about reversing Go ...
7
votes
Accepted
reversing stripped & statically linked binary with radare2
Seems like lscan is written to work with IDA. However, lscan is based on FLIRT signature files which can be also read by radare2 (See the Zignatures section of this answer). There are several things ...
- 8,919
7
votes
How to export a working elf binary from Ghidra?
Ghidra Export Binary Feature
UPDATE AS OF June 2021:
The preliminary release notes list this as a feature for Ghidra 10, which should be released "mid to end of June 2021":
New exporters ...
- 1,401
7
votes
Accepted
Meaning of Flags in ELF Section header?
The flag abbreviation of the letter "I" stands for SHF_INFO_LINK.
Since readelf is open-source you can access its code to verify this. This will also show you the full list of Flag possibilities:
......
- 8,919
7
votes
Accepted
Why have two symbols tables?
The short answer is that the .dynsym table is used by the dynamic linker (also referred to as the runtime loader or RTLD) at program load time to determine which DLLs to map into the address space of ...
- 7,078
7
votes
Accepted
Elf x86_64 adding function
It is possible to do what you want. There are some difficulties you may encounter though. I'll show you a short instruction how it can be done in several different cases.
Have a look at ELF ...
- 3,369
6
votes
Accepted
How to SUCCESSFULLY add a code section to an executable file in Linux?
libbfd is not a magic wand, it is in fact pretty limited (it's one of the reasons why GDB cannot debug files without a section table). In particular, objcopy won't add PHT entries for you, so you will ...
- 36.4k
6
votes
Accepted
Making changes in ELF file after dissassembly
Since no details about the binary are provided in the question, only a general answer can be given. It sounds like you are trying to statically modify an executable ELF binary. This is also referred ...
- 7,078
6
votes
Accepted
Ghidra python - get program base address
You can use currentProgram.getImageBase() to obtain the base address. This returns an Address object.
Example
>>> currentProgram.getImageBase()
00400000
>>> type(currentProgram....
- 6,040
6
votes
Accepted
startup program exits with code 126 when executing program at entrypoint
The program exiting with code 126 in GDB occurs when the current user does not have execute permissions for the binary being debugged:
$ ls -l test
-rw-r--r-- 1 user01 user01 110080 May 1 22:18 test
...
- 7,078
6
votes
Accepted
How to disable relro while compilation?
To enable full relro:
-Wl, -z,relro,-z,now
What does this do? - it provides -z,relro,-z,now flag to linker as an argument. This enables full relro (notice -z,now flag).
Partial relro is enabled by ...
- 1,797
5
votes
Accepted
Illegal entry point of an ELF file
File/memory mappings are always multiples of the page size, on x86 this is usually 4k. The mapping length here, 0x13c7 will be rounded up to a multiple of the page size meaning that 0x2000 bytes will ...
- 2,503
5
votes
Finding the library an imported function is from in IDA
When I had the same problem (I was working on ELF binaries from Linux and QNX systems) I had to do the following:
run ldd on the executable to get the list of loaded libraries
obtain a list of ...
- 8,408
5
votes
How can I generate a call graph from an unstripped x86 Linux ELF?
All (caller, callee)-tuples except for direct recursion and duplicates:
objdump -d $BINARY_FILENAME \
| grep '<' \
| sed -e 's/^[^<]*//' \
| sed 's/<\([^+]*\)[^>]*>/\1/' \
| awk 'BEGIN ...
- 51
5
votes
How to recover information stored in .ctors section?
As Igor stated, the .ctors section is a list of function pointers, ending with a sentinel value of 0xffffffff. To see its contents, just do
$ objdump -s -j.ctors bar.so
But your assembly file only ...
- 151
5
votes
Accepted
Dynamic analysis of malware samples
configure the VM with no access to network and create a clean snapshot before executing the first malware. Once the execution is complete revert the snapshot. Repeat that till you finish. (probably ...
- 712
5
votes
Accepted
Replace section inside ELF file
I'm not aware of any ready-made tools for such task, but I suspect in most cases the good old dd will do the task of replacing the actual bytes in the file (or maybe you can make objcopy work too). ...
- 36.4k
5
votes
Accepted
Address to file offset
Subtract 0x400000 from st_value since the address is located in the first LOAD segment of the binary.
According to the System V ABI (generic), the meaning of the st_value symbol depends on what type ...
- 7,078
5
votes
Accepted
Difference between 'readelf' and 'radare2' addresses
.symtab
The symbol table of readelf (.symtab) shows you the offset of each symbol from the base of the section the symbol is in.
As you showed us, when you listing the table you get something like ...
- 8,919
5
votes
Start analysis at any position in elf is Entry Point?
The entry point isn't the address where you starts analyzing, but the address from where the process starts executing.
Let's have a quick look at the ELF32 Header:
#define EI_NIDENT 16
typedef ...
- 8,919
5
votes
Accepted
What are the first 16 bytes in .rodata section?
Trying to provide a more general answer that would hopefully complement this answer linked in the comments.
To those who are unsure, the .rodata section in an executable contains all read-only ...
- 11.7k
Only top scored, non community-wiki answers of a minimum length are eligible