We’re rewarding the question askers & reputations are being recalculated! Read more.

Hot answers tagged

150

Conventions used plus preliminary remarks I am trimming the output of GDB for brevity since it usually shows the copyright and other information at the beginning of ever session. When I reproduce the output I'll start at the first (gdb) prompt line, or in case or auto-executed commands from the first genuine output line. In order to distinguish commands ...


54

Kernel perspective: I will try to answer from the kernel perspective, covering various OS's. Memory segmentation is the old way of accessing memory regions. All major operating systems including OSX, Linux, (from version 0.1) and Windows (from NT) are now using paging which is a better way (IMHO) of accessing memory. Intel, has always introduced backward ...


38

There are several broad ways in which you could do this. Dynamic instrumentation Tools such as PIN, Valgrind, or DynamoRIO allow you to dynamically change the behavior of a program. For instance, you can add calls to new functions at particular addresses, intercept library calls and change them, and much more. The downside is that dynamic instrumentation ...


27

I initially thought you wouldn't be able to dump the program, but it turns out that you can — see the second section of this answer. Running the program Most of the usual methods won't work because the executable is setuid. If you start the program normally, it runs with elevated privileges (euid ≠ ruid), and most debugging facilities are reserved to root. ...


26

VMWare can capture USB traffic between the device and the VM. A VMWare engineer even made an open-source tool for analyzing and visualizing USB logs - Virtual USB analyzer. Web site Tutorial Alternatively, a tool for converting VMWare logs to .pcap for analyzing in Wireshark is available from Sogeti.


26

Ida Pro runs on Windows, Linux and Mac OS, so i guess the Linux equivalent of Ida Pro is Ida Pro. The debugger that's used mostly seems to be gdb, possibly enhanced with a GUI. Hopper and Radare2 run on Linux as well.


25

ptrace can be detected by the fact that a process can only call ptrace once. if ptrace() was already called by the strace executable or a debugger, we can detect it in runtime. #include <stdio.h> #include <sys/ptrace.h> int main() { if (ptrace(PTRACE_TRACEME, 0, 1, 0) == -1) { printf("don't trace me !!\n"); return 1; ...


22

It is actually very simple and works for me just fine as you can see in the following gif: First you need to figure out the tty of the terminal you want to redirect the STDIO to (a.k.a Terminal 2, T2). You can do this by simply execute: $ tty /dev/pts/2 This tty will soon be used on the rarun2 profile file. Meantime, let's put T2 to sleep by using sleep ...


20

Even stripped libraries still must retain the symbols necessary for dynamic linking. These are usually placed in a section named .dynsym and are also pointed to by the entries in the dynamic section. For example, here's the output of readelf on a stripped Android library: Section Headers: [Nr] Name Type Addr Off Size ES ...


16

Very often, you can change the behavior of a program by carefully hooking into it. Whether you can add the functionality you want this way depends on how the program is constructed. It helps if the program comes in the form of one main executable plus several libraries. You can hook into any call that the program makes to shared libraries by linking your ...


14

Matt Cutts wrote a series of blog posts outlining the general approach of reverse-engineering a USB device and getting it working with linux, and explaining how he did this for a USB controlled toy missile launcher. You may find them a useful starting point. http://www.mattcutts.com/blog/reverse-engineering-a-windows-usb-driver/ http://www.mattcutts.com/...


14

Here is the list of few decompilation tools / resources that you may find useful. IDA Pro + Hex-Rays decompiler Hopper disassembler (has a decompiler) ODA (Online Disassembler) Retargetable Decompiler


13

Apart from the ptrace trick, you can check /proc/PID/cmdline, raise a SIGTRAP, use getppid, ... You may want to check pangu (disclamer: I'm the author). Pangu a a little toolset to mess around with debugging-related tools from the GNU project, and especially on GNU/Linux x86.


13

After decompressing and loading the kernel, you need to find a couple of tables that encode the compressed symbol table. These are (in the usual order they are placed in binary): kallsyms_addresses - a table of addresses to all public symbols in the kernel kallsyms_num_syms - not a table but just an integer with total number of symbols (should match ...


13

Injecting payload and hexadecimal addresses through program inputs depends on the type of input you get. Here is a list of all the possible inputs and the way to do it with both a pure shell environment and from within gdb. Getting inputs from char *argv[] In this case, the arguments are read from the initial command line, so the most convenient thing is: ...


12

FS points to the exception handling chain, CS and DS are filled from the OS with code and data segment. SS is the battery/stack segment. From what I remember, GS and ES are free. It shouldn't matter much if kernel or user mode (they are used by some instructions like XLAT, MOVS, and some others, so you have to use them in the same way), but just in case I'm ...


12

First of all, I have bad news for you ! Doug Lea's malloc is almost no more used in any C library implementation (even if understanding dlmalloc can help a lot to understand new ones). The new implementation that is most widely used is ptmalloc2 and the best way to learn about it is... to read the code... So, if you are using a Debian(-like) distribution, ...


12

It is possible to determine what command line arguments or options can be passed to a Linux executable. Of course, how this can be done will depend on the type and design of the program and on factors such as obfuscation, encryption, compression, etc. Hardcoded Documentation Linux executables designed to be easily usable by humans and whose behavior ...


11

functionpointer is declared before char buffer[50]; on the stack so How comes it overwrites it ??? The order of objects in the stack is implementation defined. C does not mention any stack and the direction of the stack growing is also implementation-defined (usually it grows downwards but in some systems it grows upwards). In your case functionpointer is ...


10

Okay, assuming vanilla UPX you should be fine by detecting the strings UPX! or UPX0. As far as I remember this would also work on Windows. So it's a shell one-liner such as: grep UPX\! <filename> or grep UPX0 <filename> ... assuming the GNU version of grep here. Another method, but using the same principle: $ hexdump -C <filename> |...


10

I found a small tool which uses ptrace to single step instructions from a forked child which executed another program: http://pastebin.com/yHbkc0Je This worked perfectly. I got a dump of all the instructions used. I know that it didn't run with the setuid privileges, but it will probably help me anyway. Now I only need something to disassemble the ...


10

In fact, ldd is loading the libraries on-the-fly to list what libraries are needed. So, on this run, you can say that libc.so.6 has been loaded at 0xb7e5c000, but you have no warranty that it will always be the case. Even with no ASLR, it is mainly depending on the loading order of the libraries that might vary from one run to another. Nevertheless, ...


10

There are a plethora of things programmers do not know about how ELF binaries work internally. And, unfortunately, there's almost no solid references apart from two or three which broadly cover the subject. Many tools (linkers, loaders, assemblers, debuggers, ...) remain a mystery for most of you. When it comes to linkers and loaders, the main reference is ...


10

If you look at offset 0xDF of your backup file you'll see the two bytes: 0x78 0xDA These commonly delimit the beginning of a zlib compressed file. In fact, the original XML config file has been split up into multiple zlib compressed blocks: $ binwalk default-config.bin DECIMAL HEXADECIMAL DESCRIPTION ------------------------------------------...


10

Current IDA versions (as of 6.5) are pretty much equivalent for all three platforms. You can disassemble all file formats on all three platforms. You can definitely analyze PE and Mach-O files on Linux. Most debuggers are also available on all platforms. A couple of features are available only in the Windows version: WinDbg and Symbian debuggers WinCE ...


10

On Linux, in protected mode, the segment registers aren't standard "segments" anymore, instead, they're called selectors, and include information if the segment is readable/writable/executable. The real address they're pointing to is "hidden" in a table in the kernel and the segment register is used as an index into that table, but the physical address ...


10

Hypothesis: the file is encrypted 1. Absence of Compression Signatures The relevant compression formats that Binwalk detects are as follows: bzip2, lzop, lzip, lrzip, LZO, 7z, gzip, rzip, LZMA, zlib, and LZ4. Since running Binwalk against H201LV2.0_Cur_config.bin returns no results even though Binwalk normally will recognize any of these compression ...


9

You mentioned that you do have a running kernel available. It is possible to obtain symbol information from a running kernel by reading /proc/kallsyms. On newer distributions, this information is disabled by default for security reasons (all symbols will be displayed as 0x0 addresses), but you can manually enable it by running the following command as root:...


9

So, it is totally untested but here is the result of a few Internet browsing. First the stack base address is present in /proc/<pid>/maps, then it must be accessible from user-space at some point. I looked at the code of the pstack command which is printing the content of the stack of a running process. This code is getting the base address from a ...


9

There are several tools that I have used: PEiD (PE iDentifier) I've also followed this guide and converted PEiD signatures to YARA signatures and simply used YARA TRiD can also provide another way to identify the compiler used It's also worth mentioning that if you submit a file to Virus Total, they will run TRiD against your binary. These tools are not ...


Only top voted, non community-wiki answers of a minimum length are eligible