52
votes
Cross debugging for ARM / MIPS ELF with QEMU/toolchain
Get Ready for an Adventure!
You need a few things for your quest! Let's start at the beginning.
QEMU and GDB
QEMU is an emulator for various architectures. Generally, it's used to emulate an ...
- 2,279
44
votes
Visualizing ELF binaries
The tool we used for the talk, binviz, is available here: binviz_0.zip.
Some papers are here:
taxonomy-bh.pdf;
2008_VizSEC_FileVisualization_v53_final.pdf
And, there is also an earlier Black Hat ...
- 441
31
votes
Visualizing ELF binaries
cantor.dust
This project is an interactive binary visualization tool, a radical
evolution of the traditional hex editor. By translating binary
information to a visual abstraction, reverse engineers ...
- 1,908
30
votes
What is PLT/GOT?
Let me summarize the links given at https://reverseengineering.stackexchange.com/a/1993/12321 without going into serious disasembly analysis for now.
When the Linux kernel + dynamic linker is going ...
24
votes
Accepted
Set a breakpoint on GDB entry point for stripped PIE binaries without disabling ASLR
UPDATE: GDB 8.1 has a starti command, as mentioned below by /u/ruslan
Setting a breakpoint on an unmapped address before starting the target process does this, effectively. It's not correct ...
- 2,279
21
votes
Accepted
Why I can not directly get the content of `.bss` section?
The .bss has no content. It's simply a tip to the loader to preallocate some space when starting the program. It will be all 0s at the execution and won't hold any useful information until the program ...
- 261
20
votes
Accepted
How to generate the call graph of a binary file?
You can use radare2 or one of the alternatives below to generate a full call-graph in dot format.
radare2 Installation
First of all, install radare2 from git repository:
$ git clone https://...
- 8,639
16
votes
Accepted
Writing ELF headers in Radare?
Yes, obviously you can. radare2 has built-in features to handle binary headers. This including reading, parsing and modifying the headers of the binary. And this is not different for elf or pe files, ...
- 8,639
14
votes
Why are GOT and PLT still present in Linux static stripped binaries?
There are a plethora of things programmers do not know about how ELF binaries work internally. And, unfortunately, there's almost no solid references apart from two or three which broadly cover the ...
- 2,603
13
votes
Visualizing ELF binaries
These are graphic dumps from the source data. I use this extensively, with a hex reader I wrote myself -- it's a great way to quickly locate "data" (see the difference between .text and .data) and ...
- 2,274
13
votes
Visualizing ELF binaries
The data visualizing tool I saw used in the talk seems to be almost identical if not identical to the BinVis tool available on Google Code. A screenshot of some of the features:
Note: the above is an ...
- 474
11
votes
Set a breakpoint on GDB entry point for stripped PIE binaries without disabling ASLR
Starting with GDB 8.1, there's a special command for this: starti. Example GDB session:
$ gdb /bin/true
Reading symbols from /bin/true...(no debugging symbols found)...done.
(gdb) starti
Starting ...
- 283
10
votes
Visualizing ELF binaries
BinView is a prototype for a tool for binary data visualization
GitHub repository
- 101
10
votes
Accepted
Understanding gdb output
Seems like relocation. If you look at the addresses in your first listing, you will notice that these addresses are unusually low. That's probably because gdb displays file offsets there (although I ...
- 2,826
9
votes
Accepted
Why ther are some many padding/leading nop instructions in my binary code?
Alignment.
Note that all of the NOPs end (and the next function begins) at ...C0, ...F0. The compiler and/or linker inserted padding bytes so that the functions begin at 0x10 aligned addresses.
...
9
votes
Accepted
How to recover information stored in .ctors section?
The .ctors section is a list of pointers terminated with -1 (0xFFFFFFFF), so it does not make sense to disassemble it. If you rearrange the bytes as data, you get:
__CTOR_LIST__: .long 0xffffffff
...
- 34.7k
9
votes
How can I generate a call graph from an unstripped x86 Linux ELF?
Radare2 is also able to collect the callgraph of a program based on its binary only.
Some time ago, I asked this question which is somehow related to yours and one of the author of Radare2 answered:
...
- 18.1k
9
votes
Accepted
Find function in a stripped dynamic ELF library
There're two broad ways in which you can declare JNI functions.
The first is the more obvious way in which the JNI function has to follow a specific naming convention like JNIEXPORT void JNICALL ...
- 5,850
8
votes
Visualizing ELF binaries
I wrote https://github.com/REMath/implementations/blob/master/code_examples/plot_hex.py which implements the ngram method presented Conti as well as a clustering component to isolate visual properties....
- 153
8
votes
How to generate the call graph of a binary file?
You might want to give angr a try.
Load the binary. Suppose p is the angr Project instance.
Generate a CFG: cfg = p.analyses.CFG(show_progressbar=True).
Access/traverse the call graph (which is a ...
- 184
8
votes
Accepted
ELF x86 - Why is return address pushed twice?
It was present on the stack before and esp, 0xfffffff0 instruction that aligns the stack to 16 bytes. This instruction doesn't erase the data that was previously at esp (so ecx-4 still points to the ...
- 3,189
7
votes
Accepted
How to deal with this "error" instructions generated by objdump?
This is just the ugly AT&T syntax. In Intel syntax it's:
jmp dword ptr [eax*4+0x80509e4]
And yes, it's most likely a jump table.
You can switch objdump to Intel syntax by adding -M intel to the ...
- 34.7k
7
votes
Reverse engineering a golang binary file
I'm afraid your intentions to find memory usage may need both static and dynamic analysis. Run-time events can cause more or less memory usage. I will write my general findings about reversing Go ...
7
votes
Accepted
reversing stripped & statically linked binary with radare2
Seems like lscan is written to work with IDA. However, lscan is based on FLIRT signature files which can be also read by radare2 (See the Zignatures section of this answer). There are several things ...
- 8,639
7
votes
How to export a working elf binary from Ghidra?
Ghidra Export Binary Feature
UPDATE AS OF June 2021:
The preliminary release notes list this as a feature for Ghidra 10, which should be released "mid to end of June 2021":
New exporters ...
- 1,176
7
votes
Accepted
Why have two symbols tables?
The short answer is that the .dynsym table is used by the dynamic linker (also referred to as the runtime loader or RTLD) at program load time to determine which DLLs to map into the address space of ...
- 6,859
6
votes
Why I can not directly get the content of `.bss` section?
The .bss block started by symbol (also called Uninitialized data segment - bss is an old assembly instruction on an ancient IBM chip) section is supposed to contain global variables and static ...
- 2,603
6
votes
Accepted
How to SUCCESSFULLY add a code section to an executable file in Linux?
libbfd is not a magic wand, it is in fact pretty limited (it's one of the reasons why GDB cannot debug files without a section table). In particular, objcopy won't add PHT entries for you, so you will ...
- 34.7k
6
votes
Why are symbols with local binding present in the symbol table of my ELF files?
Symbol Binding and Symbol Visibility
What are they needed for?
There must be a way for the link editor (ld) to determine the scope of a symbol during link-time. In other words, symbol binding ...
- 6,859
6
votes
Accepted
Making changes in ELF file after dissassembly
Since no details about the binary are provided in the question, only a general answer can be given. It sounds like you are trying to statically modify an executable ELF binary. This is also referred ...
- 6,859
Only top scored, non community-wiki answers of a minimum length are eligible