Hot answers tagged

38 votes

What is PLT/GOT?

Let me summarize the links given at https://reverseengineering.stackexchange.com/a/1993/12321 without going into serious disasembly analysis for now. When the Linux kernel + dynamic linker is going ...
Ciro Santilli OurBigBook.com's user avatar
21 votes
Accepted

How to generate the call graph of a binary file?

You can use radare2 or one of the alternatives below to generate a full call-graph in dot format. radare2 Installation First of all, install radare2 from git repository: $ git clone https://...
Megabeets's user avatar
  • 8,919
15 votes
Accepted

Writing ELF headers in Radare?

Yes, obviously you can. radare2 has built-in features to handle binary headers. This including reading, parsing and modifying the headers of the binary. And this is not different for elf or pe files, ...
Megabeets's user avatar
  • 8,919
11 votes

Set a breakpoint on GDB entry point for stripped PIE binaries without disabling ASLR

Starting with GDB 8.1, there's a special command for this: starti. Example GDB session: $ gdb /bin/true Reading symbols from /bin/true...(no debugging symbols found)...done. (gdb) starti Starting ...
Ruslan's user avatar
  • 283
10 votes
Accepted

Understanding gdb output

Seems like relocation. If you look at the addresses in your first listing, you will notice that these addresses are unusually low. That's probably because gdb displays file offsets there (although I ...
Nordwald's user avatar
  • 2,896
9 votes
Accepted

Find function in a stripped dynamic ELF library

There're two broad ways in which you can declare JNI functions. The first is the more obvious way in which the JNI function has to follow a specific naming convention like JNIEXPORT void JNICALL ...
0xec's user avatar
  • 6,040
8 votes

Why are symbols with local binding present in the symbol table of my ELF files?

Symbol Binding and Symbol Visibility What are they needed for? There must be a way for the link editor (ld) to determine the scope of a symbol during link-time. In other words, symbol binding ...
julian's user avatar
  • 7,078
8 votes

How to generate the call graph of a binary file?

You might want to give angr a try. Load the binary. Suppose p is the angr Project instance. Generate a CFG: cfg = p.analyses.CFG(show_progressbar=True). Access/traverse the call graph (which is a ...
Fish's user avatar
  • 194
8 votes
Accepted

ELF x86 - Why is return address pushed twice?

It was present on the stack before and esp, 0xfffffff0 instruction that aligns the stack to 16 bytes. This instruction doesn't erase the data that was previously at esp (so ecx-4 still points to the ...
bart1e's user avatar
  • 3,369
7 votes

Reverse engineering a golang binary file

I'm afraid your intentions to find memory usage may need both static and dynamic analysis. Run-time events can cause more or less memory usage. I will write my general findings about reversing Go ...
Kerim Can Kalıpcıoğlu's user avatar
7 votes
Accepted

reversing stripped & statically linked binary with radare2

Seems like lscan is written to work with IDA. However, lscan is based on FLIRT signature files which can be also read by radare2 (See the Zignatures section of this answer). There are several things ...
Megabeets's user avatar
  • 8,919
7 votes

How to export a working elf binary from Ghidra?

Ghidra Export Binary Feature UPDATE AS OF June 2021: The preliminary release notes list this as a feature for Ghidra 10, which should be released "mid to end of June 2021": New exporters ...
Florian Magin's user avatar
7 votes
Accepted

Meaning of Flags in ELF Section header?

The flag abbreviation of the letter "I" stands for SHF_INFO_LINK. Since readelf is open-source you can access its code to verify this. This will also show you the full list of Flag possibilities: ......
Megabeets's user avatar
  • 8,919
7 votes
Accepted

Why have two symbols tables?

The short answer is that the .dynsym table is used by the dynamic linker (also referred to as the runtime loader or RTLD) at program load time to determine which DLLs to map into the address space of ...
julian's user avatar
  • 7,078
7 votes
Accepted

Elf x86_64 adding function

It is possible to do what you want. There are some difficulties you may encounter though. I'll show you a short instruction how it can be done in several different cases. Have a look at ELF ...
bart1e's user avatar
  • 3,369
6 votes
Accepted

How to SUCCESSFULLY add a code section to an executable file in Linux?

libbfd is not a magic wand, it is in fact pretty limited (it's one of the reasons why GDB cannot debug files without a section table). In particular, objcopy won't add PHT entries for you, so you will ...
Igor Skochinsky's user avatar
  • 36.4k
6 votes
Accepted

Making changes in ELF file after dissassembly

Since no details about the binary are provided in the question, only a general answer can be given. It sounds like you are trying to statically modify an executable ELF binary. This is also referred ...
julian's user avatar
  • 7,078
6 votes
Accepted

Ghidra python - get program base address

You can use currentProgram.getImageBase() to obtain the base address. This returns an Address object. Example >>> currentProgram.getImageBase() 00400000 >>> type(currentProgram....
0xec's user avatar
  • 6,040
6 votes
Accepted

startup program exits with code 126 when executing program at entrypoint

The program exiting with code 126 in GDB occurs when the current user does not have execute permissions for the binary being debugged: $ ls -l test -rw-r--r-- 1 user01 user01 110080 May 1 22:18 test ...
julian's user avatar
  • 7,078
6 votes
Accepted

How to disable relro while compilation?

To enable full relro: -Wl, -z,relro,-z,now What does this do? - it provides -z,relro,-z,now flag to linker as an argument. This enables full relro (notice -z,now flag). Partial relro is enabled by ...
R4444's user avatar
  • 1,797
5 votes
Accepted

Illegal entry point of an ELF file

File/memory mappings are always multiples of the page size, on x86 this is usually 4k. The mapping length here, 0x13c7 will be rounded up to a multiple of the page size meaning that 0x2000 bytes will ...
Ian Cook's user avatar
  • 2,503
5 votes

Finding the library an imported function is from in IDA

When I had the same problem (I was working on ELF binaries from Linux and QNX systems) I had to do the following: run ldd on the executable to get the list of loaded libraries obtain a list of ...
w s's user avatar
  • 8,408
5 votes

How can I generate a call graph from an unstripped x86 Linux ELF?

All (caller, callee)-tuples except for direct recursion and duplicates: objdump -d $BINARY_FILENAME \ | grep '<' \ | sed -e 's/^[^<]*//' \ | sed 's/<\([^+]*\)[^>]*>/\1/' \ | awk 'BEGIN ...
lambda's user avatar
  • 51
5 votes

How to recover information stored in .ctors section?

As Igor stated, the .ctors section is a list of function pointers, ending with a sentinel value of 0xffffffff. To see its contents, just do $ objdump -s -j.ctors bar.so But your assembly file only ...
csl's user avatar
  • 151
5 votes
Accepted

Dynamic analysis of malware samples

configure the VM with no access to network and create a clean snapshot before executing the first malware. Once the execution is complete revert the snapshot. Repeat that till you finish. (probably ...
GelosSnake's user avatar
5 votes
Accepted

Replace section inside ELF file

I'm not aware of any ready-made tools for such task, but I suspect in most cases the good old dd will do the task of replacing the actual bytes in the file (or maybe you can make objcopy work too). ...
Igor Skochinsky's user avatar
  • 36.4k
5 votes
Accepted

Address to file offset

Subtract 0x400000 from st_value since the address is located in the first LOAD segment of the binary. According to the System V ABI (generic), the meaning of the st_value symbol depends on what type ...
julian's user avatar
  • 7,078
5 votes
Accepted

Difference between 'readelf' and 'radare2' addresses

.symtab The symbol table of readelf (.symtab) shows you the offset of each symbol from the base of the section the symbol is in. As you showed us, when you listing the table you get something like ...
Megabeets's user avatar
  • 8,919
5 votes

Start analysis at any position in elf is Entry Point?

The entry point isn't the address where you starts analyzing, but the address from where the process starts executing. Let's have a quick look at the ELF32 Header: #define EI_NIDENT 16 typedef ...
Megabeets's user avatar
  • 8,919
5 votes
Accepted

What are the first 16 bytes in .rodata section?

Trying to provide a more general answer that would hopefully complement this answer linked in the comments. To those who are unsure, the .rodata section in an executable contains all read-only ...
NirIzr's user avatar
  • 11.7k

Only top scored, non community-wiki answers of a minimum length are eligible