58
Getting the entrypoint
If you have no useful symbol, you first need to find the entrypoint of the executable. There are several ways to do it (depending on the tools you have or the tools you like the best):
Using readelf
$> readelf -h /bin/ls
ELF Header:
Magic: 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00
Class: ELF64
...
52
Get Ready for an Adventure!
You need a few things for your quest! Let's start at the beginning.
QEMU and GDB
QEMU is an emulator for various architectures. Generally, it's used to emulate an entire PC (i.e. to run a virtual machine). However, for debugging a single program this is not necessary. On Linux, you can use QEMU User-Space emulation.
$ sudo ...
44
The tool we used for the talk, binviz, is available here: binviz_0.zip.
Some papers are here:
taxonomy-bh.pdf;
2008_VizSEC_FileVisualization_v53_final.pdf
And, there is also an earlier Black Hat talk, in addition to the one I
did with Sergey:
(200808_binviz38_dc_final.ppt)
I haven't used it in a while but binviz was written in Visual C# (VS2005
or maybe ...
31
cantor.dust
This project is an interactive binary visualization tool, a radical
evolution of the traditional hex editor. By translating binary
information to a visual abstraction, reverse engineers and forensic
analysts can sift through mountains of arbitrary data in seconds.
Even previously unseen instruction sets and data formats can be easily
located and ...
27
Let me summarize the links given at https://reverseengineering.stackexchange.com/a/1993/12321 without going into serious disasembly analysis for now.
When the Linux kernel + dynamic linker is going to run a binary with exec, it traditionally just dumped the ELF section into a known memory location specified by the linker during link time.
So, whenever ...
23
UPDATE: GDB 8.1 has a starti command, as mentioned below by /u/ruslan
Setting a breakpoint on an unmapped address before starting the target process does this, effectively. It's not correct functionality, but rather a side-effect of the failure to set the breakpoint.
(gdb) break *0
Breakpoint 1 at 0x0
(gdb) r
Starting program: /home/user/ld.so
Error in ...
21
The .bss has no content. It's simply a tip to the loader to preallocate some space when starting the program. It will be all 0s at the execution and won't hold any useful information until the program writes to it. After that, you can use a debugger to dump the memory and explore its content.
Check the Wikipedia page for more information.
20
You can use radare2 or one of the alternatives below to generate a full call-graph in dot format.
radare2 Installation
First of all, install radare2 from git repository:
$ git clone https://github.com/radare/radare2.git
$ cd radare2
$ ./sys/install.sh
Analysis
After you've downloaded and installed radare2, open your binary and perform analysis on it ...
16
Yes, obviously you can. radare2 has built-in features to handle binary headers. This including reading, parsing and modifying the headers of the binary. And this is not different for elf or pe files, it will work great with both.
TL;DR
$ ./example.elf
[*] you ran this binary!
$ r2 -w -nn example.elf
[0x00000000]> .pf.elf_header.entry=0x0000063a
[...
13
The data visualizing tool I saw used in the talk seems to be almost identical if not identical to the BinVis tool available on Google Code. A screenshot of some of the features:
Note: the above is an old version as I could not install the latest on my PC; see Google code site for more.
13
There are a plethora of things programmers do not know about how ELF binaries work internally. And, unfortunately, there's almost no solid references apart from two or three which broadly cover the subject. Many tools (linkers, loaders, assemblers, debuggers, ...) remain a mystery for most of you. When it comes to linkers and loaders, the main reference is ...
13
These are graphic dumps from the source data. I use this extensively, with a hex reader I wrote myself -- it's a great way to quickly locate "data" (see the difference between .text and .data) and larger structures (which often contain repeating or similar data on the same offsets).
The top images show raw data dumped as grayscale information: each byte is ...
11
It's very easy to prevent the UPX tool to unpack an UPX compressed file. If you take a look to the source code you will see that it checks for the magic string UPX_MAGIC_LE32 in p_lx_interp.cpp. So, I simply changed all matches of the string (in binary chunks) "UPX!" to "AAA!". I copied /bin/ls (ELF64) to another folder and packed with UPX. Then I edited it ...
11
Starting with GDB 8.1, there's a special command for this: starti. Example GDB session:
$ gdb /bin/true
Reading symbols from /bin/true...(no debugging symbols found)...done.
(gdb) starti
Starting program: /bin/true
Program stopped.
0xf7fdd800 in _start () from /lib/ld-linux.so.2
(gdb) x/5i $pc
=> 0xf7fdd800 <_start>: mov eax,esp
0xf7fdd802 &...
10
BinView is a prototype for a tool for binary data visualization
GitHub repository
10
Seems like relocation. If you look at the addresses in your first listing, you will notice that these addresses are unusually low. That's probably because gdb displays file offsets there (although I have no idea why that is the case for you).
When you run the file, the loader kicks in and maps the sections to the virtual address space of the program, and ...
9
Alignment.
Note that all of the NOPs end (and the next function begins) at ...C0, ...F0. The compiler and/or linker inserted padding bytes so that the functions begin at 0x10 aligned addresses.
Different compilers / linkers will use different values for these bytes. I've seen 90 (nop), CC (int3), as well as multi-byte NOPs that exactly fill the space ...
9
The .ctors section is a list of pointers terminated with -1 (0xFFFFFFFF), so it does not make sense to disassemble it. If you rearrange the bytes as data, you get:
__CTOR_LIST__: .long 0xffffffff
__CTOR_END__: .long 0x00000000
So, for whatever reason, the resulting exe does not actually use the .ctors section. I suspect the linker instead placed the ...
9
Radare2 is also able to collect the callgraph of a program based on its binary only.
Some time ago, I asked this question which is somehow related to yours and one of the author of Radare2 answered:
Recursive traversal disassembling with Radare2?
Yet, if you want a graphical representation of the callgraph here is the way to do:
$> radare2 /usr/bin/...
9
There're two broad ways in which you can declare JNI functions.
The first is the more obvious way in which the JNI function has to follow a specific naming convention like JNIEXPORT void JNICALL Java_com_app_foo_bar. You can easily identify such functions using readelf.
The other not so obvious way is to use RegisterNatives. Here your functions can have ...
8
Apart from the classix UPX, you should take a look at Burneye (With its crackers, UNFburninhell and Burndump) and elfuck. They are pretty old, but still interesting.
If you are interested about tricks that can be used, this is a good introduction by aczid, and I would also recommend Binary protection schemes for a more complete overview.
Someone also ...
8
I wrote https://github.com/REMath/implementations/blob/master/code_examples/plot_hex.py which implements the ngram method presented Conti as well as a clustering component to isolate visual properties.
8
You might want to give angr a try.
Load the binary. Suppose p is the angr Project instance.
Generate a CFG: cfg = p.analyses.CFG(show_progressbar=True).
Access/traverse the call graph (which is a networkx.DiGraph) in whatever way you want: cfg.functions.callgraph.
For example showing the call graph only of specific address range or specific static ...
8
It was present on the stack before and esp, 0xfffffff0 instruction that aligns the stack to 16 bytes. This instruction doesn't erase the data that was previously at esp (so ecx-4 still points to the return address), but stack pointer points now to possibly different value than at the begining of the function. So there is a need to push the return value ([ecx-...
7
This is just the ugly AT&T syntax. In Intel syntax it's:
jmp dword ptr [eax*4+0x80509e4]
And yes, it's most likely a jump table.
You can switch objdump to Intel syntax by adding -M intel to the command line.
7
I'm afraid your intentions to find memory usage may need both static and dynamic analysis. Run-time events can cause more or less memory usage. I will write my general findings about reversing Go binaries, you can choose for your application-specific solution from below.
There is no decompiling tool available for Go language. Although according to this ...
7
Seems like lscan is written to work with IDA. However, lscan is based on FLIRT signature files which can be also read by radare2 (See the Zignatures section of this answer). There are several things you can do with radare2 to achieve similar results:
Import IDA databases to radare2
You can easily import IDC and IDB files from IDA to radare2 using a simple ...
7
Ghidra Export Binary Feature
UPDATE AS OF June 2021:
The preliminary release notes list this as a feature for Ghidra 10, which should be released "mid to end of June 2021":
New exporters that write programs imported with the PE and ELF loaders back to their original file layout have been added.
Any file-backed bytes that were modified by the user ...
7
The short answer is that the .dynsym table is used by the dynamic linker (also referred to as the runtime loader or RTLD) at program load time to determine which DLLs to map into the address space of the program being loaded into memory. As a result, the .dynsym section is mapped to a loadable segment (specifically, the text segment) and therefore included ...
6
The .bss block started by symbol (also called Uninitialized data segment - bss is an old assembly instruction on an ancient IBM chip) section is supposed to contain global variables and static variables uninitialized or initialized to 0 or NULL. The .bss section is usually non existing until your program starts executing, this is why you can't retrieve its ...
Only top voted, non community-wiki answers of a minimum length are eligible