31
votes
Accepted
Managing inputs for payload injection?
Injecting payload and hexadecimal addresses through program inputs depends on the type of input you get. Here is a list of all the possible inputs and the way to do it with both a pure shell ...
- 19.2k
28
votes
Accepted
Debugging with radare2 using two terminals
It is actually very simple and works for me just fine as you can see in the following gif:
First you need to figure out the tty of the terminal you want to redirect the STDIO to (a.k.a Terminal 2, T2)...
- 9,009
18
votes
How to reverse engineer a Linux executable to find the parameters?
It is possible to determine what command line arguments or options can be passed to a Linux executable. Of course, how this can be done will depend on the type and design of the program and on factors ...
- 7,246
16
votes
How does glibc malloc work?
For understanding how dynamic memory allocation (the malloc, free, calloc, realloc library functions) really works there is no substitute for reading the source code of malloc(). It is well commented:
...
- 7,246
14
votes
Identify compression of this ZTE ZXV10 H201L V2 backup config file
Hypothesis: the file is encrypted
1. Absence of Compression Signatures
The relevant compression formats that Binwalk detects are as follows: bzip2, lzop, lzip, lrzip, LZO, 7z, gzip, rzip, LZMA, zlib,...
- 7,246
13
votes
Accepted
ARM64 syscalls table
arm64 syscall numbers are defined at: https://github.com/torvalds/linux/blob/v4.17/include/uapi/asm-generic/unistd.h
This is a bit confusing since it is quite different from x86 and x86_64 and arm 32-...
12
votes
What is the linux equivalent to OllyDbg and Ida Pro?
edb is a cross platform x86/x86-64 debugger. It was inspired by Ollydbg, but aims to function on x86 and x86-64 as well as multiple OS's.
https://github.com/eteran/edb-debugger
- 246
11
votes
ZTE encrypted backup config file
Updated for August 2020:
The below information is accurate to the best of my knowledge. It has been used to decrypt config.bin on 2 different routers at the time of writing.
The obfuscated section ...
- 266
10
votes
How does glibc malloc work?
There are several quite good references about the exploitation of the heap in software security, one of my favorite is probably the 'binary hacking course' from LiveOverflow.
You can look at the ...
- 19.2k
9
votes
Why are symbols with local binding present in the symbol table of my ELF files?
Symbol Binding and Symbol Visibility
What are they needed for?
There must be a way for the link editor (ld) to determine the scope of a symbol during link-time. In other words, symbol binding ...
- 7,246
9
votes
ARM64 syscalls table
Update: See this answer for up-to-date information on where ARM64 syscall definitions are found. Note that the information below may just be for backwards-compatibility.
See arch/arm64/include/asm/...
- 191
9
votes
Accepted
What does fs and gs registers provide in Linux?
The gs/fs segment can be used for thread local storage similar to what you have encountered in Windows. Variable specific to a thread such as errno, stack canary etc are usually stored here in Linux.
...
- 2,719
8
votes
How are the segment registers (fs, gs, cs, ss, ds, es) used in Linux?
i wrote a windows specific answer to a question that was marked as duplicate and closed and the close flag referred to this thread so i post an answer here
os win7 sp1 32 bit machine
kernel dump ...
- 16.5k
8
votes
Accepted
Identify compression of this ZTE ZXV10 H201L V2 backup config file
The encryption for recent ZTE routers' config.bin is AES ECB (Electronic Code Book). The key is stored in the open in /bin/cspd next to string /cfg/db_backup_cfg.xml. The function responsible is ...
- 96
7
votes
Reverse engineering a golang binary file
I'm afraid your intentions to find memory usage may need both static and dynamic analysis. Run-time events can cause more or less memory usage. I will write my general findings about reversing Go ...
7
votes
Accepted
How does API call work on Android (NDK)?
To answer your question, let us first set a solid ground in terms of entities and definitions.
ELF stands for "Executable and Linkable format".
That is, it defines the structure and shape of two ...
- 86
7
votes
Accepted
Why have two symbols tables?
The short answer is that the .dynsym table is used by the dynamic linker (also referred to as the runtime loader or RTLD) at program load time to determine which DLLs to map into the address space of ...
- 7,246
6
votes
Use Android Shared library (.so) files in Linux
First, extract the whole APK (it's a renamed ZIP) and check whether there's not a x86 version of the binary, in addition of the ARM. It will depend on the best option to choose.
The following options ...
6
votes
What is the linux equivalent to OllyDbg and Ida Pro?
As an (2019) addition to all the other answers:
Try Ghidra.
It is the Software Reverse Engineering (SRE) suit of the NSA and it's free and open source. It was leaked as part of Wikileaks' "Vault 7" ...
- 161
6
votes
Accepted
How to SUCCESSFULLY add a code section to an executable file in Linux?
libbfd is not a magic wand, it is in fact pretty limited (it's one of the reasons why GDB cannot debug files without a section table). In particular, objcopy won't add PHT entries for you, so you will ...
- 36.9k
6
votes
Accepted
How do I go about overriding a function internally defined in a binary on Linux?
You have several options here, but I like this one.
Since the code is already inside the executable, so you have to patch the entrypoint to jump to a new function.
To do so, I suggest to use a shared ...
- 1,179
5
votes
What is the linux equivalent to OllyDbg and Ida Pro?
I would say radare2. It is opensource fast moving project, and it has analysis capibilites similar to that of ida, and supports many architectures like x86 and the 64bit version of x86 plus lots of ...
- 335
5
votes
How can I generate a call graph from an unstripped x86 Linux ELF?
All (caller, callee)-tuples except for direct recursion and duplicates:
objdump -d $BINARY_FILENAME \
| grep '<' \
| sed -e 's/^[^<]*//' \
| sed 's/<\([^+]*\)[^>]*>/\1/' \
| awk 'BEGIN ...
- 51
5
votes
Accepted
Master of Orion and scanmem
This means you only caught the displayed game credits value. Steam is used for multiplayer and online games. So it is very likely that the original value is stored on a server and only the value to be ...
5
votes
Reverse Engineering ZyXel C1100Z modem firmware
The password seems to be generated dynamically from /etc/profile
...
# generate login files
echo "supervisor:3Gnc.CJE1790M:0:0:Administrator:/:/bin/sh" > /var/passwd
echo "root::0:root,...
- 1,341
5
votes
Accepted
Remote Debugging Linux Binaries - Stack Address Changes?
On modern Linux machines ASLR is enabled by default. As a result, when the process image for the binary is created in virtual memory, the base address of the stack is located at a random offset:
/*
*...
- 7,246
5
votes
OTOOL alternative for linux
I am in a similar position carrying out iOS related work on an Ubuntu host.
The suggestions to use objdump will not work unless it has been compiled specifically with support of Mach-O binaries which ...
- 177
5
votes
Accepted
Can I trap SIGSEGV (on a Linux) and what are are the conditions to make it works? (for a crackme)
A solution working in Windows was given in my question - this way, you can cause program to continue after it receives SIGSEGV.
You can do similar thing on linux (though I would recommend using ...
- 3,429
5
votes
Unknown archive format from QNX operating system
Although some clues on the file's origin could be useful, the format seems to be pretty simple so can be deduced from the sample. It is not a full-fledged filesystem but a simple archive/package.
...
- 36.9k
5
votes
Accepted
How to use linux .debug file with Ghidra
Ghidra can in fact parse the .debug section and DWARF information in general, but the error message you posted indicates that it is refusing to do so, because of the too large number of records. It ...
- 1,459
Only top scored, non community-wiki answers of a minimum length are eligible