New answers tagged linux
0
The boot log seems similar to the one from this page, so there's a high possibility this device is using an AllWinner SoC. You can try the tools from the linked repository.
Another option could be to dump the flash and analyze it.
0
I'm not sure how much of a spoiler you want, so I'll keep it fairly short for now.
The buffer is too short
Your main problem is somewhat a hint towards the solution. The logic is, if your buffer is too small, then make a new one that can fit your entire payload.
By this, I mean you need to set up a stack pivot. A stack pivot allows you to move the stack ...
0
A simpler way, since you have the firmware image, is to chroot into the device's root file system (e.g. # chroot path/to/firmware /bin/sh). This will alleviate any dynamic loading issues that may be tedious to fix.
The only requirement is that you have the qemu binary installed for the correct architecture.
0
It is possible that the address is relocated.
The relocation table, typically named .reloc contains address "translations" for the loader, placing bytes in file offsets in different addresses in runtime.
0
Yes, this is called Position Independent Executable (PIE). It randomizes the base address of the executable. It is enabled by default nowadays in most cases by gcc/the linker.
There are several ways to statically determine whether a binary is built with PIE. One method is to use file; a PIE binary reports "shared object" (since that's what it is) compared ...
2
Assuming nothing is cryptographically signed, that should be possible. You simply need to follow your steps in reverse. If you used binwalk's extract option, that made it too easy; you'll want to figure out how to unpack/pack the image manually (maybe the verbose option will provide more info on the steps taken). I realize this is a generic sounding answer, ...
1
I recommend to use IDA for this task but you can try something other. There are dozens of disassemblers.
Open your app in the disassebmler, locate something like that:
Scroll up and find XRef with 'qt_metacast(char const*)' (in case the binary is not stripped):
.rodata:00069B90 aMainwindow_0 db 'MainWindow',0 ; DATA XREF: MainWindow::qt_metacast(...
Top 50 recent answers are included
