Skip to main content
31 votes
Accepted

Managing inputs for payload injection?

Injecting payload and hexadecimal addresses through program inputs depends on the type of input you get. Here is a list of all the possible inputs and the way to do it with both a pure shell ...
perror's user avatar
  • 19.1k
28 votes
Accepted

Debugging with radare2 using two terminals

It is actually very simple and works for me just fine as you can see in the following gif: First you need to figure out the tty of the terminal you want to redirect the STDIO to (a.k.a Terminal 2, T2)...
Megabeets's user avatar
  • 8,999
18 votes

How to reverse engineer a Linux executable to find the parameters?

It is possible to determine what command line arguments or options can be passed to a Linux executable. Of course, how this can be done will depend on the type and design of the program and on factors ...
julian's user avatar
  • 7,158
16 votes

How does glibc malloc work?

For understanding how dynamic memory allocation (the malloc, free, calloc, realloc library functions) really works there is no substitute for reading the source code of malloc(). It is well commented: ...
julian's user avatar
  • 7,158
14 votes

Identify compression of this ZTE ZXV10 H201L V2 backup config file

Hypothesis: the file is encrypted 1. Absence of Compression Signatures The relevant compression formats that Binwalk detects are as follows: bzip2, lzop, lzip, lrzip, LZO, 7z, gzip, rzip, LZMA, zlib,...
julian's user avatar
  • 7,158
13 votes
Accepted

ARM64 syscalls table

arm64 syscall numbers are defined at: https://github.com/torvalds/linux/blob/v4.17/include/uapi/asm-generic/unistd.h This is a bit confusing since it is quite different from x86 and x86_64 and arm 32-...
Ciro Santilli OurBigBook.com's user avatar
11 votes

ZTE encrypted backup config file

Updated for August 2020: The below information is accurate to the best of my knowledge. It has been used to decrypt config.bin on 2 different routers at the time of writing. The obfuscated section ...
mkst's user avatar
  • 266
11 votes

What is the linux equivalent to OllyDbg and Ida Pro?

edb is a cross platform x86/x86-64 debugger. It was inspired by Ollydbg, but aims to function on x86 and x86-64 as well as multiple OS's. https://github.com/eteran/edb-debugger
firebitsbr's user avatar
10 votes

How does glibc malloc work?

There are several quite good references about the exploitation of the heap in software security, one of my favorite is probably the 'binary hacking course' from LiveOverflow. You can look at the ...
perror's user avatar
  • 19.1k
9 votes

Why are symbols with local binding present in the symbol table of my ELF files?

Symbol Binding and Symbol Visibility What are they needed for? There must be a way for the link editor (ld) to determine the scope of a symbol during link-time. In other words, symbol binding ...
julian's user avatar
  • 7,158
9 votes

ARM64 syscalls table

Update: See this answer for up-to-date information on where ARM64 syscall definitions are found. Note that the information below may just be for backwards-compatibility. See arch/arm64/include/asm/...
tonysdg's user avatar
  • 191
9 votes
Accepted

What does fs and gs registers provide in Linux?

The gs/fs segment can be used for thread local storage similar to what you have encountered in Windows. Variable specific to a thread such as errno, stack canary etc are usually stored here in Linux. ...
sudhackar's user avatar
  • 2,709
8 votes

How are the segment registers (fs, gs, cs, ss, ds, es) used in Linux?

i wrote a windows specific answer to a question that was marked as duplicate and closed and the close flag referred to this thread so i post an answer here os win7 sp1 32 bit machine kernel dump ...
blabb's user avatar
  • 16.4k
8 votes
Accepted

Identify compression of this ZTE ZXV10 H201L V2 backup config file

The encryption for recent ZTE routers' config.bin is AES ECB (Electronic Code Book). The key is stored in the open in /bin/cspd next to string /cfg/db_backup_cfg.xml. The function responsible is ...
user20993's user avatar
7 votes

Reverse engineering a golang binary file

I'm afraid your intentions to find memory usage may need both static and dynamic analysis. Run-time events can cause more or less memory usage. I will write my general findings about reversing Go ...
Kerim Can Kalıpcıoğlu's user avatar
7 votes
Accepted

How does API call work on Android (NDK)?

To answer your question, let us first set a solid ground in terms of entities and definitions. ELF stands for "Executable and Linkable format". That is, it defines the structure and shape of two ...
Lero's user avatar
  • 86
7 votes
Accepted

Why have two symbols tables?

The short answer is that the .dynsym table is used by the dynamic linker (also referred to as the runtime loader or RTLD) at program load time to determine which DLLs to map into the address space of ...
julian's user avatar
  • 7,158
6 votes

Segmentation fault while pushing onto the stack

The segmentation fault error doesn't have anything to do with pushing the strings on the stack. I used gdb to debug it, and the problem lies at: ;exit(int ret) mov al,1 xor ebx, ebx int 0x80 ...
JeffreyZ's user avatar
  • 219
6 votes

What is the linux equivalent to OllyDbg and Ida Pro?

As an (2019) addition to all the other answers: Try Ghidra. It is the Software Reverse Engineering (SRE) suit of the NSA and it's free and open source. It was leaked as part of Wikileaks' "Vault 7" ...
NullDev's user avatar
  • 161
6 votes

Use Android Shared library (.so) files in Linux

First, extract the whole APK (it's a renamed ZIP) and check whether there's not a x86 version of the binary, in addition of the ARM. It will depend on the best option to choose. The following options ...
Cécile Bertau's user avatar
6 votes
Accepted

How to SUCCESSFULLY add a code section to an executable file in Linux?

libbfd is not a magic wand, it is in fact pretty limited (it's one of the reasons why GDB cannot debug files without a section table). In particular, objcopy won't add PHT entries for you, so you will ...
Igor Skochinsky's user avatar
  • 36.7k
5 votes

Reversing Hisense TV Firmware

My achievements. I added to the startup telnetd, and ftpd. I found cifs.ko. kernel module And now added to mount network folders on boot. It works faster than dlna, in addition, I was able to solve ...
hawkeye's user avatar
  • 51
5 votes

How can I generate a call graph from an unstripped x86 Linux ELF?

All (caller, callee)-tuples except for direct recursion and duplicates: objdump -d $BINARY_FILENAME \ | grep '<' \ | sed -e 's/^[^<]*//' \ | sed 's/<\([^+]*\)[^>]*>/\1/' \ | awk 'BEGIN ...
lambda's user avatar
  • 51
5 votes

What is the linux equivalent to OllyDbg and Ida Pro?

I would say radare2. It is opensource fast moving project, and it has analysis capibilites similar to that of ida, and supports many architectures like x86 and the 64bit version of x86 plus lots of ...
u185619's user avatar
  • 335
5 votes
Accepted

Master of Orion and scanmem

This means you only caught the displayed game credits value. Steam is used for multiplayer and online games. So it is very likely that the original value is stored on a server and only the value to be ...
Sebastian Parschauer's user avatar
5 votes

Reverse Engineering ZyXel C1100Z modem firmware

The password seems to be generated dynamically from /etc/profile ... # generate login files echo "supervisor:3Gnc.CJE1790M:0:0:Administrator:/:/bin/sh" > /var/passwd echo "root::0:root,...
cimarron's user avatar
  • 1,341
5 votes
Accepted

Remote Debugging Linux Binaries - Stack Address Changes?

On modern Linux machines ASLR is enabled by default. As a result, when the process image for the binary is created in virtual memory, the base address of the stack is located at a random offset: /* *...
julian's user avatar
  • 7,158
5 votes
Accepted

How do I go about overriding a function internally defined in a binary on Linux?

You have several options here, but I like this one. Since the code is already inside the executable, so you have to patch the entrypoint to jump to a new function. To do so, I suggest to use a shared ...
wisk's user avatar
  • 1,154
5 votes

OTOOL alternative for linux

I am in a similar position carrying out iOS related work on an Ubuntu host. The suggestions to use objdump will not work unless it has been compiled specifically with support of Mach-O binaries which ...
Jon's user avatar
  • 177
5 votes

Unknown archive format from QNX operating system

Although some clues on the file's origin could be useful, the format seems to be pretty simple so can be deduced from the sample. It is not a full-fledged filesystem but a simple archive/package. ...
Igor Skochinsky's user avatar
  • 36.7k

Only top scored, non community-wiki answers of a minimum length are eligible