4
The third one is an array to environment variables that this program has access to. If you read the documentation of execve it reads as follows:
The argument vector and environment can be accessed by the called
program's main function, when it is defined as:
int main(int argc, char *argv[], char *envp[])
Note, however, that the use of a third ...
2
There's a couple of likely possibilities for how the value of Pi is included in the code -
1) It is calculated using trig functions. e.g.
4.0 * atan( 1.0 )
2) It is stored as a floating-point constant. In hexadecimal representation these could be -
0x40490FDB // 32-bit floating point
0x400921FB54442D18 // 64-bit floating point
However, ...
1
You can't just remove bytes since that would shift the following opcodes and invalidate all relative jumps/calls. The usual approach in such cases is patching the junk instructions with NOPs (0x90 for x86/x64). You can write a smalls script to do it (e.g. using patch_byte).
1
Procedure:
Get base address in x64dbg: Load the binary in x64dbg. Go to "Memory Map" tab.
Find the binary name in info column. Then copy the address with the right
click on it. For example, in the following screenshot, the x86_64 PE binary
name is Project1.exe and the base address is 0x00007FF6A4850000.
Rebase in IDA: Open the binary in IDA. Click on Edit >...
1
I would say this really depends on your definition of packing. Typically packing is limited to compression moreso than protection. In this case the binary is updated to maintain virtual memory while minimizing file size. The entry point will decompress everything so, despite the files differing, the virtual memory at the point of executing the original entry ...
1
Is there a difference between unpacked and dumped that I should know about while loading it in IDA to see the actual imports section?
You can dump anything not only packed binaries, but with packed ones it usually comes with stripped imports table just to make it hard(-er) to analyze.
After sample is unpacked it usually rebuild its import table so it can ...
1
Here are the required steps using Igor Skochinsky's answer:
Clone musl git repository:
git clone --depth=1 git://git.musl-libc.org/musl
Compile the code:
cd musl; ./configure; make -s -j2
Extract Flair tool from IDA SDK. Run pelf (ELF parser) with the musl static
library which is compiled in above step:
cd ./lib
~/flair/bin/linux/pelf libc.a
The ...
Only top voted, non community-wiki answers of a minimum length are eligible
