Hot answers tagged

31 votes
Accepted

What is the linux equivalent to OllyDbg and Ida Pro?

Ida Pro runs on Windows, Linux and Mac OS, so i guess the Linux equivalent of Ida Pro is Ida Pro. The debugger that's used mostly seems to be gdb, possibly enhanced with a GUI. Hopper and Radare2 run ...
user avatar
28 votes
Accepted

Debugging with radare2 using two terminals

It is actually very simple and works for me just fine as you can see in the following gif: First you need to figure out the tty of the terminal you want to redirect the STDIO to (a.k.a Terminal 2, T2)...
user avatar
  • 8,659
26 votes
Accepted

Managing inputs for payload injection?

Injecting payload and hexadecimal addresses through program inputs depends on the type of input you get. Here is a list of all the possible inputs and the way to do it with both a pure shell ...
user avatar
  • 18.1k
18 votes

How to reverse engineer a Linux executable to find the parameters?

It is possible to determine what command line arguments or options can be passed to a Linux executable. Of course, how this can be done will depend on the type and design of the program and on factors ...
user avatar
  • 6,859
14 votes

Why are GOT and PLT still present in Linux static stripped binaries?

There are a plethora of things programmers do not know about how ELF binaries work internally. And, unfortunately, there's almost no solid references apart from two or three which broadly cover the ...
user avatar
  • 2,603
14 votes

Identify compression of this ZTE ZXV10 H201L V2 backup config file

Hypothesis: the file is encrypted 1. Absence of Compression Signatures The relevant compression formats that Binwalk detects are as follows: bzip2, lzop, lzip, lrzip, LZO, 7z, gzip, rzip, LZMA, zlib,...
user avatar
  • 6,859
13 votes

How does glibc malloc work?

For understanding how dynamic memory allocation (the malloc, free, calloc, realloc library functions) really works there is no substitute for reading the source code of malloc(). It is well commented: ...
user avatar
  • 6,859
12 votes
Accepted

ARM64 syscalls table

arm64 syscall numbers are defined at: https://github.com/torvalds/linux/blob/v4.17/include/uapi/asm-generic/unistd.h This is a bit confusing since it is quite different from x86 and x86_64 and arm 32-...
user avatar
11 votes
Accepted

Setting a breakpoint at system call

In gdb you can set a syscall breakpoint with catch syscall. If this is in 32-bit x86 (IA-32), check the syscall number in your_linux_source_dir/usr/include/asm/unistd_32.h. There is no syscall called ...
user avatar
  • 425
11 votes

ZTE encrypted backup config file

Updated for August 2020: The below information is accurate to the best of my knowledge. It has been used to decrypt config.bin on 2 different routers at the time of writing. The obfuscated section ...
user avatar
  • 256
10 votes

Can IDA Pro on Linux disassemble a Windows PE (or Mac OS X app)?

Current IDA versions (as of 6.5) are pretty much equivalent for all three platforms. You can disassemble all file formats on all three platforms. You can definitely analyze PE and Mach-O files on ...
user avatar
  • 34.9k
10 votes

Understanding segment prefixes in assembly for Linux

On Linux, in protected mode, the segment registers aren't standard "segments" anymore, instead, they're called selectors, and include information if the segment is readable/writable/executable. The ...
user avatar
10 votes

What is the linux equivalent to OllyDbg and Ida Pro?

edb is a cross platform x86/x86-64 debugger. It was inspired by Ollydbg, but aims to function on x86 and x86-64 as well as multiple OS's. https://github.com/eteran/edb-debugger
user avatar
9 votes
Accepted

Why are values passed through useless copies?

There are no artifacts and surely the compiler, and I mean GCC, can generate a better and faster code if told so. The first version of your generated code is non optimized. Why ? Either because -O0 ...
user avatar
  • 2,603
9 votes
Accepted

How does this version of `rm -rf /` work?

It's not run in the example. It's a shellcode, it has to be somehow injected (for example using a buffer overflow vulnerability). To understand how it works, let's first put some addresses on the ...
user avatar
9 votes

How can I generate a call graph from an unstripped x86 Linux ELF?

Radare2 is also able to collect the callgraph of a program based on its binary only. Some time ago, I asked this question which is somehow related to yours and one of the author of Radare2 answered: ...
user avatar
  • 18.1k
9 votes

How does glibc malloc work?

There are several quite good references about the exploitation of the heap in software security, one of my favorite is probably the 'binary hacking course' from LiveOverflow. You can look at the ...
user avatar
  • 18.1k
9 votes

ARM64 syscalls table

Update: See this answer for up-to-date information on where ARM64 syscall definitions are found. Note that the information below may just be for backwards-compatibility. See arch/arm64/include/asm/...
user avatar
  • 191
8 votes

How are the segment registers (fs, gs, cs, ss, ds, es) used in Linux?

i wrote a windows specific answer to a question that was marked as duplicate and closed and the close flag referred to this thread so i post an answer here os win7 sp1 32 bit machine kernel dump ...
user avatar
  • 15k
8 votes

Why does `ldd` and `(gdb) info sharedlibrary` show a different library base address?

ldd The program ldd is wrong for a few reasons. First, ldd is not meant to be accurate for determining load addresses. Use the environment variable LD_TRACE_LOADED_OBJECTS. Second, ldd will never ...
user avatar
  • 2,277
8 votes
Accepted

How to stop debugger right after the execution?

Binaries are usually stripped. For ELF binaries, you can check it with file command $ file /bin/true /bin/true: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked (uses shared ...
user avatar
  • 455
8 votes

Reversing self-modifying code

Just for kicks I downloaded the crackme and fed it to radare in a windows box dynamic analysis is not needed to solve this crackme radare2 facets lets string this binary [0x080495e0]> iz vaddr=...
user avatar
  • 15k
8 votes
Accepted

Identify compression of this ZTE ZXV10 H201L V2 backup config file

The encryption for recent ZTE routers' config.bin is AES ECB (Electronic Code Book). The key is stored in the open in /bin/cspd next to string /cfg/db_backup_cfg.xml. The function responsible is ...
user avatar
8 votes
Accepted

What does fs and gs registers provide in Linux?

The gs/fs segment can be used for thread local storage similar to what you have encountered in Windows. Variable specific to a thread such as errno, stack canary etc are usually stored here in Linux. ...
user avatar
  • 2,389
7 votes

Reverse engineering a golang binary file

I'm afraid your intentions to find memory usage may need both static and dynamic analysis. Run-time events can cause more or less memory usage. I will write my general findings about reversing Go ...
user avatar
7 votes
Accepted

Why have two symbols tables?

The short answer is that the .dynsym table is used by the dynamic linker (also referred to as the runtime loader or RTLD) at program load time to determine which DLLs to map into the address space of ...
user avatar
  • 6,859
6 votes

Did somebody start to reverse engineer the proprietary Linux Brother Cups drivers?

I created a free driver for my Brother printer, available at github.com/pdewacht/brlaser. It's known to work with the Brother DCP-7030 and DCP-7065DN. If anybody tries it, I'd like to hear your ...
user avatar
  • 276
6 votes
Accepted

Find sigtrap function

That's where strace comes in handy. If i make your program compilable and compile it: $cat trap.c #include <signal.h> void sigtrap_func(int sig) { puts("trap"); } int main() { signal(SIGTRAP,...
user avatar
6 votes

How to stop debugger right after the execution?

From http://lldb.llvm.org/tutorial.html: (lldb) process launch --stop-at-entry -- -program_arg value Note your break main is a gdb command; lldbs error message isnt "no such symbol", it's "invalid ...
user avatar
6 votes

Segmentation fault while pushing onto the stack

The segmentation fault error doesn't have anything to do with pushing the strings on the stack. I used gdb to debug it, and the problem lies at: ;exit(int ret) mov al,1 xor ebx, ebx int 0x80 ...
user avatar
  • 219

Only top scored, non community-wiki answers of a minimum length are eligible