Hot answers tagged

31 votes
Accepted

What is the linux equivalent to OllyDbg and Ida Pro?

Ida Pro runs on Windows, Linux and Mac OS, so i guess the Linux equivalent of Ida Pro is Ida Pro. The debugger that's used mostly seems to be gdb, possibly enhanced with a GUI. Hopper and Radare2 run ...
28 votes
Accepted

Debugging with radare2 using two terminals

It is actually very simple and works for me just fine as you can see in the following gif: First you need to figure out the tty of the terminal you want to redirect the STDIO to (a.k.a Terminal 2, T2)...
  • 8,779
27 votes
Accepted

Managing inputs for payload injection?

Injecting payload and hexadecimal addresses through program inputs depends on the type of input you get. Here is a list of all the possible inputs and the way to do it with both a pure shell ...
  • 18.4k
18 votes

How to reverse engineer a Linux executable to find the parameters?

It is possible to determine what command line arguments or options can be passed to a Linux executable. Of course, how this can be done will depend on the type and design of the program and on factors ...
  • 6,948
14 votes

Identify compression of this ZTE ZXV10 H201L V2 backup config file

Hypothesis: the file is encrypted 1. Absence of Compression Signatures The relevant compression formats that Binwalk detects are as follows: bzip2, lzop, lzip, lrzip, LZO, 7z, gzip, rzip, LZMA, zlib,...
  • 6,948
14 votes

How does glibc malloc work?

For understanding how dynamic memory allocation (the malloc, free, calloc, realloc library functions) really works there is no substitute for reading the source code of malloc(). It is well commented: ...
  • 6,948
13 votes
Accepted

ARM64 syscalls table

arm64 syscall numbers are defined at: https://github.com/torvalds/linux/blob/v4.17/include/uapi/asm-generic/unistd.h This is a bit confusing since it is quite different from x86 and x86_64 and arm 32-...
11 votes
Accepted

Setting a breakpoint at system call

In gdb you can set a syscall breakpoint with catch syscall. If this is in 32-bit x86 (IA-32), check the syscall number in your_linux_source_dir/usr/include/asm/unistd_32.h. There is no syscall called ...
  • 425
11 votes

ZTE encrypted backup config file

Updated for August 2020: The below information is accurate to the best of my knowledge. It has been used to decrypt config.bin on 2 different routers at the time of writing. The obfuscated section ...
  • 256
10 votes

What is the linux equivalent to OllyDbg and Ida Pro?

edb is a cross platform x86/x86-64 debugger. It was inspired by Ollydbg, but aims to function on x86 and x86-64 as well as multiple OS's. https://github.com/eteran/edb-debugger
10 votes

How does glibc malloc work?

There are several quite good references about the exploitation of the heap in software security, one of my favorite is probably the 'binary hacking course' from LiveOverflow. You can look at the ...
  • 18.4k
9 votes
Accepted

How does this version of `rm -rf /` work?

It's not run in the example. It's a shellcode, it has to be somehow injected (for example using a buffer overflow vulnerability). To understand how it works, let's first put some addresses on the ...
9 votes

Why does `ldd` and `(gdb) info sharedlibrary` show a different library base address?

ldd The program ldd is wrong for a few reasons. First, ldd is not meant to be accurate for determining load addresses. Use the environment variable LD_TRACE_LOADED_OBJECTS. Second, ldd will never ...
  • 2,297
9 votes

How can I generate a call graph from an unstripped x86 Linux ELF?

Radare2 is also able to collect the callgraph of a program based on its binary only. Some time ago, I asked this question which is somehow related to yours and one of the author of Radare2 answered: ...
  • 18.4k
9 votes

ARM64 syscalls table

Update: See this answer for up-to-date information on where ARM64 syscall definitions are found. Note that the information below may just be for backwards-compatibility. See arch/arm64/include/asm/...
  • 191
8 votes

How are the segment registers (fs, gs, cs, ss, ds, es) used in Linux?

i wrote a windows specific answer to a question that was marked as duplicate and closed and the close flag referred to this thread so i post an answer here os win7 sp1 32 bit machine kernel dump ...
  • 15.6k
8 votes
Accepted

How to stop debugger right after the execution?

Binaries are usually stripped. For ELF binaries, you can check it with file command $ file /bin/true /bin/true: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked (uses shared ...
  • 465
8 votes

Reversing self-modifying code

Just for kicks I downloaded the crackme and fed it to radare in a windows box dynamic analysis is not needed to solve this crackme radare2 facets lets string this binary [0x080495e0]> iz vaddr=...
  • 15.6k
8 votes
Accepted

Identify compression of this ZTE ZXV10 H201L V2 backup config file

The encryption for recent ZTE routers' config.bin is AES ECB (Electronic Code Book). The key is stored in the open in /bin/cspd next to string /cfg/db_backup_cfg.xml. The function responsible is ...
8 votes
Accepted

What does fs and gs registers provide in Linux?

The gs/fs segment can be used for thread local storage similar to what you have encountered in Windows. Variable specific to a thread such as errno, stack canary etc are usually stored here in Linux. ...
  • 2,409
7 votes

Reverse engineering a golang binary file

I'm afraid your intentions to find memory usage may need both static and dynamic analysis. Run-time events can cause more or less memory usage. I will write my general findings about reversing Go ...
7 votes
Accepted

Why have two symbols tables?

The short answer is that the .dynsym table is used by the dynamic linker (also referred to as the runtime loader or RTLD) at program load time to determine which DLLs to map into the address space of ...
  • 6,948
6 votes

How to stop debugger right after the execution?

From http://lldb.llvm.org/tutorial.html: (lldb) process launch --stop-at-entry -- -program_arg value Note your break main is a gdb command; lldbs error message isnt "no such symbol", it's "invalid ...
6 votes

Debugging forked child in an anti-debug protected crackme

Use dbg.forks=true to stop the debugger when a fork happens. and then just use dp to list and select the pid you want to follow.
  • 407
6 votes

Segmentation fault while pushing onto the stack

The segmentation fault error doesn't have anything to do with pushing the strings on the stack. I used gdb to debug it, and the problem lies at: ;exit(int ret) mov al,1 xor ebx, ebx int 0x80 ...
  • 219
6 votes
Accepted

How to SUCCESSFULLY add a code section to an executable file in Linux?

libbfd is not a magic wand, it is in fact pretty limited (it's one of the reasons why GDB cannot debug files without a section table). In particular, objcopy won't add PHT entries for you, so you will ...
  • 35.5k
6 votes

Why are symbols with local binding present in the symbol table of my ELF files?

Symbol Binding and Symbol Visibility What are they needed for? There must be a way for the link editor (ld) to determine the scope of a symbol during link-time. In other words, symbol binding ...
  • 6,948
6 votes
Accepted

How does API call work on Android (NDK)?

To answer your question, let us first set a solid ground in terms of entities and definitions. ELF stands for "Executable and Linkable format". That is, it defines the structure and shape of two ...
  • 76
5 votes
Accepted

How can I change the value of a variable while debugging?

Google is your friend: For example, if your program has a variable width, you get an error if you try to set a new value with just `set width=13', because GDB has the command set width: (gdb) ...
  • 2,972
5 votes

What is the linux equivalent to OllyDbg and Ida Pro?

As an (2019) addition to all the other answers: Try Ghidra. It is the Software Reverse Engineering (SRE) suit of the NSA and it's free and open source. It was leaked as part of Wikileaks' "Vault 7" ...
  • 151

Only top scored, non community-wiki answers of a minimum length are eligible