Hot answers tagged

52 votes

Cross debugging for ARM / MIPS ELF with QEMU/toolchain

Get Ready for an Adventure! You need a few things for your quest! Let's start at the beginning. QEMU and GDB QEMU is an emulator for various architectures. Generally, it's used to emulate an ...
user avatar
  • 2,279
44 votes

Visualizing ELF binaries

The tool we used for the talk, binviz, is available here: binviz_0.zip. Some papers are here: taxonomy-bh.pdf; 2008_VizSEC_FileVisualization_v53_final.pdf And, there is also an earlier Black Hat ...
user avatar
31 votes

Visualizing ELF binaries

cantor.dust This project is an interactive binary visualization tool, a radical evolution of the traditional hex editor. By translating binary information to a visual abstraction, reverse engineers ...
user avatar
30 votes

What is PLT/GOT?

Let me summarize the links given at https://reverseengineering.stackexchange.com/a/1993/12321 without going into serious disasembly analysis for now. When the Linux kernel + dynamic linker is going ...
user avatar
24 votes
Accepted

Set a breakpoint on GDB entry point for stripped PIE binaries without disabling ASLR

UPDATE: GDB 8.1 has a starti command, as mentioned below by /u/ruslan Setting a breakpoint on an unmapped address before starting the target process does this, effectively. It's not correct ...
user avatar
  • 2,279
21 votes
Accepted

Why I can not directly get the content of `.bss` section?

The .bss has no content. It's simply a tip to the loader to preallocate some space when starting the program. It will be all 0s at the execution and won't hold any useful information until the program ...
user avatar
  • 261
20 votes
Accepted

How to generate the call graph of a binary file?

You can use radare2 or one of the alternatives below to generate a full call-graph in dot format. radare2 Installation First of all, install radare2 from git repository: $ git clone https://...
user avatar
  • 8,639
16 votes
Accepted

Writing ELF headers in Radare?

Yes, obviously you can. radare2 has built-in features to handle binary headers. This including reading, parsing and modifying the headers of the binary. And this is not different for elf or pe files, ...
user avatar
  • 8,639
14 votes

Why are GOT and PLT still present in Linux static stripped binaries?

There are a plethora of things programmers do not know about how ELF binaries work internally. And, unfortunately, there's almost no solid references apart from two or three which broadly cover the ...
user avatar
  • 2,603
13 votes

Visualizing ELF binaries

These are graphic dumps from the source data. I use this extensively, with a hex reader I wrote myself -- it's a great way to quickly locate "data" (see the difference between .text and .data) and ...
user avatar
  • 2,274
13 votes

Visualizing ELF binaries

The data visualizing tool I saw used in the talk seems to be almost identical if not identical to the BinVis tool available on Google Code. A screenshot of some of the features: Note: the above is an ...
user avatar
  • 474
11 votes

Set a breakpoint on GDB entry point for stripped PIE binaries without disabling ASLR

Starting with GDB 8.1, there's a special command for this: starti. Example GDB session: $ gdb /bin/true Reading symbols from /bin/true...(no debugging symbols found)...done. (gdb) starti Starting ...
user avatar
  • 283
10 votes

Visualizing ELF binaries

BinView is a prototype for a tool for binary data visualization GitHub repository
user avatar
  • 101
10 votes
Accepted

Understanding gdb output

Seems like relocation. If you look at the addresses in your first listing, you will notice that these addresses are unusually low. That's probably because gdb displays file offsets there (although I ...
user avatar
  • 2,826
9 votes
Accepted

Why ther are some many padding/leading nop instructions in my binary code?

Alignment. Note that all of the NOPs end (and the next function begins) at ...C0, ...F0. The compiler and/or linker inserted padding bytes so that the functions begin at 0x10 aligned addresses. ...
user avatar
9 votes
Accepted

How to recover information stored in .ctors section?

The .ctors section is a list of pointers terminated with -1 (0xFFFFFFFF), so it does not make sense to disassemble it. If you rearrange the bytes as data, you get: __CTOR_LIST__: .long 0xffffffff ...
user avatar
  • 34.7k
9 votes

How can I generate a call graph from an unstripped x86 Linux ELF?

Radare2 is also able to collect the callgraph of a program based on its binary only. Some time ago, I asked this question which is somehow related to yours and one of the author of Radare2 answered: ...
user avatar
  • 18.1k
9 votes
Accepted

Find function in a stripped dynamic ELF library

There're two broad ways in which you can declare JNI functions. The first is the more obvious way in which the JNI function has to follow a specific naming convention like JNIEXPORT void JNICALL ...
user avatar
  • 5,850
8 votes

Visualizing ELF binaries

I wrote https://github.com/REMath/implementations/blob/master/code_examples/plot_hex.py which implements the ngram method presented Conti as well as a clustering component to isolate visual properties....
user avatar
  • 153
8 votes

How to generate the call graph of a binary file?

You might want to give angr a try. Load the binary. Suppose p is the angr Project instance. Generate a CFG: cfg = p.analyses.CFG(show_progressbar=True). Access/traverse the call graph (which is a ...
user avatar
  • 184
8 votes
Accepted

ELF x86 - Why is return address pushed twice?

It was present on the stack before and esp, 0xfffffff0 instruction that aligns the stack to 16 bytes. This instruction doesn't erase the data that was previously at esp (so ecx-4 still points to the ...
user avatar
  • 3,189
7 votes
Accepted

How to deal with this "error" instructions generated by objdump?

This is just the ugly AT&T syntax. In Intel syntax it's: jmp dword ptr [eax*4+0x80509e4] And yes, it's most likely a jump table. You can switch objdump to Intel syntax by adding -M intel to the ...
user avatar
  • 34.7k
7 votes

Reverse engineering a golang binary file

I'm afraid your intentions to find memory usage may need both static and dynamic analysis. Run-time events can cause more or less memory usage. I will write my general findings about reversing Go ...
user avatar
7 votes
Accepted

reversing stripped & statically linked binary with radare2

Seems like lscan is written to work with IDA. However, lscan is based on FLIRT signature files which can be also read by radare2 (See the Zignatures section of this answer). There are several things ...
user avatar
  • 8,639
7 votes

How to export a working elf binary from Ghidra?

Ghidra Export Binary Feature UPDATE AS OF June 2021: The preliminary release notes list this as a feature for Ghidra 10, which should be released "mid to end of June 2021": New exporters ...
user avatar
7 votes
Accepted

Why have two symbols tables?

The short answer is that the .dynsym table is used by the dynamic linker (also referred to as the runtime loader or RTLD) at program load time to determine which DLLs to map into the address space of ...
user avatar
  • 6,859
6 votes

Why I can not directly get the content of `.bss` section?

The .bss block started by symbol (also called Uninitialized data segment - bss is an old assembly instruction on an ancient IBM chip) section is supposed to contain global variables and static ...
user avatar
  • 2,603
6 votes
Accepted

How to SUCCESSFULLY add a code section to an executable file in Linux?

libbfd is not a magic wand, it is in fact pretty limited (it's one of the reasons why GDB cannot debug files without a section table). In particular, objcopy won't add PHT entries for you, so you will ...
user avatar
  • 34.7k
6 votes

Why are symbols with local binding present in the symbol table of my ELF files?

Symbol Binding and Symbol Visibility What are they needed for? There must be a way for the link editor (ld) to determine the scope of a symbol during link-time. In other words, symbol binding ...
user avatar
  • 6,859
6 votes
Accepted

Making changes in ELF file after dissassembly

Since no details about the binary are provided in the question, only a general answer can be given. It sounds like you are trying to statically modify an executable ELF binary. This is also referred ...
user avatar
  • 6,859

Only top scored, non community-wiki answers of a minimum length are eligible