31
votes
Accepted
Managing inputs for payload injection?
Injecting payload and hexadecimal addresses through program inputs depends on the type of input you get. Here is a list of all the possible inputs and the way to do it with both a pure shell ...
- 18.9k
28
votes
Accepted
Debugging with radare2 using two terminals
It is actually very simple and works for me just fine as you can see in the following gif:
First you need to figure out the tty of the terminal you want to redirect the STDIO to (a.k.a Terminal 2, T2)...
- 8,919
18
votes
How to reverse engineer a Linux executable to find the parameters?
It is possible to determine what command line arguments or options can be passed to a Linux executable. Of course, how this can be done will depend on the type and design of the program and on factors ...
- 7,078
15
votes
How does glibc malloc work?
For understanding how dynamic memory allocation (the malloc, free, calloc, realloc library functions) really works there is no substitute for reading the source code of malloc(). It is well commented:
...
- 7,078
14
votes
Identify compression of this ZTE ZXV10 H201L V2 backup config file
Hypothesis: the file is encrypted
1. Absence of Compression Signatures
The relevant compression formats that Binwalk detects are as follows: bzip2, lzop, lzip, lrzip, LZO, 7z, gzip, rzip, LZMA, zlib,...
- 7,078
13
votes
Accepted
ARM64 syscalls table
arm64 syscall numbers are defined at: https://github.com/torvalds/linux/blob/v4.17/include/uapi/asm-generic/unistd.h
This is a bit confusing since it is quite different from x86 and x86_64 and arm 32-...
11
votes
What is the linux equivalent to OllyDbg and Ida Pro?
edb is a cross platform x86/x86-64 debugger. It was inspired by Ollydbg, but aims to function on x86 and x86-64 as well as multiple OS's.
https://github.com/eteran/edb-debugger
- 236
11
votes
ZTE encrypted backup config file
Updated for August 2020:
The below information is accurate to the best of my knowledge. It has been used to decrypt config.bin on 2 different routers at the time of writing.
The obfuscated section ...
- 266
10
votes
How does glibc malloc work?
There are several quite good references about the exploitation of the heap in software security, one of my favorite is probably the 'binary hacking course' from LiveOverflow.
You can look at the ...
- 18.9k
9
votes
Reversing self-modifying code
Just for kicks I downloaded the crackme and fed it to radare in a windows box dynamic analysis is not needed to solve this crackme
radare2 facets
lets string this binary
[0x080495e0]> iz
vaddr=...
- 16.3k
9
votes
ARM64 syscalls table
Update: See this answer for up-to-date information on where ARM64 syscall definitions are found. Note that the information below may just be for backwards-compatibility.
See arch/arm64/include/asm/...
- 191
9
votes
Accepted
What does fs and gs registers provide in Linux?
The gs/fs segment can be used for thread local storage similar to what you have encountered in Windows. Variable specific to a thread such as errno, stack canary etc are usually stored here in Linux.
...
- 2,629
8
votes
How are the segment registers (fs, gs, cs, ss, ds, es) used in Linux?
i wrote a windows specific answer to a question that was marked as duplicate and closed and the close flag referred to this thread so i post an answer here
os win7 sp1 32 bit machine
kernel dump ...
- 16.3k
8
votes
Accepted
Identify compression of this ZTE ZXV10 H201L V2 backup config file
The encryption for recent ZTE routers' config.bin is AES ECB (Electronic Code Book). The key is stored in the open in /bin/cspd next to string /cfg/db_backup_cfg.xml. The function responsible is ...
- 96
8
votes
Why are symbols with local binding present in the symbol table of my ELF files?
Symbol Binding and Symbol Visibility
What are they needed for?
There must be a way for the link editor (ld) to determine the scope of a symbol during link-time. In other words, symbol binding ...
- 7,078
7
votes
Reverse engineering a golang binary file
I'm afraid your intentions to find memory usage may need both static and dynamic analysis. Run-time events can cause more or less memory usage. I will write my general findings about reversing Go ...
7
votes
Accepted
How does API call work on Android (NDK)?
To answer your question, let us first set a solid ground in terms of entities and definitions.
ELF stands for "Executable and Linkable format".
That is, it defines the structure and shape of two ...
- 86
7
votes
Accepted
Why have two symbols tables?
The short answer is that the .dynsym table is used by the dynamic linker (also referred to as the runtime loader or RTLD) at program load time to determine which DLLs to map into the address space of ...
- 7,078
6
votes
Debugging forked child in an anti-debug protected crackme
Use dbg.forks=true to stop the debugger when a fork happens. and then just use dp to list and select the pid you want to follow.
- 482
6
votes
Use Android Shared library (.so) files in Linux
First, extract the whole APK (it's a renamed ZIP) and check whether there's not a x86 version of the binary, in addition of the ARM. It will depend on the best option to choose.
The following options ...
6
votes
What is the linux equivalent to OllyDbg and Ida Pro?
As an (2019) addition to all the other answers:
Try Ghidra.
It is the Software Reverse Engineering (SRE) suit of the NSA and it's free and open source. It was leaked as part of Wikileaks' "Vault 7" ...
- 161
6
votes
Segmentation fault while pushing onto the stack
The segmentation fault error doesn't have anything to do with pushing the strings on the stack.
I used gdb to debug it, and the problem lies at:
;exit(int ret)
mov al,1
xor ebx, ebx
int 0x80
...
- 219
6
votes
Accepted
How to SUCCESSFULLY add a code section to an executable file in Linux?
libbfd is not a magic wand, it is in fact pretty limited (it's one of the reasons why GDB cannot debug files without a section table). In particular, objcopy won't add PHT entries for you, so you will ...
- 36.4k
5
votes
What is the linux equivalent to OllyDbg and Ida Pro?
I would say radare2. It is opensource fast moving project, and it has analysis capibilites similar to that of ida, and supports many architectures like x86 and the 64bit version of x86 plus lots of ...
- 335
5
votes
How can I generate a call graph from an unstripped x86 Linux ELF?
All (caller, callee)-tuples except for direct recursion and duplicates:
objdump -d $BINARY_FILENAME \
| grep '<' \
| sed -e 's/^[^<]*//' \
| sed 's/<\([^+]*\)[^>]*>/\1/' \
| awk 'BEGIN ...
- 51
5
votes
Reversing Hisense TV Firmware
My achievements.
I added to the startup telnetd, and ftpd.
I found cifs.ko. kernel module And now added to mount network folders on boot. It works faster than dlna, in addition, I was able to solve ...
- 51
5
votes
Accepted
Master of Orion and scanmem
This means you only caught the displayed game credits value. Steam is used for multiplayer and online games. So it is very likely that the original value is stored on a server and only the value to be ...
5
votes
Reverse Engineering ZyXel C1100Z modem firmware
The password seems to be generated dynamically from /etc/profile
...
# generate login files
echo "supervisor:3Gnc.CJE1790M:0:0:Administrator:/:/bin/sh" > /var/passwd
echo "root::0:root,...
- 1,331
5
votes
Accepted
Remote Debugging Linux Binaries - Stack Address Changes?
On modern Linux machines ASLR is enabled by default. As a result, when the process image for the binary is created in virtual memory, the base address of the stack is located at a random offset:
/*
*...
- 7,078
5
votes
Unknown archive format from QNX operating system
Although some clues on the file's origin could be useful, the format seems to be pretty simple so can be deduced from the sample. It is not a full-fledged filesystem but a simple archive/package.
...
- 36.4k
Only top scored, non community-wiki answers of a minimum length are eligible