Hello! Sorry for English, but I don't know russian. I'm trying to reverse linux i386 binary. It is packed with unknown packer. 1. Anybody knows any good linux tools for examine binary (ELF) like PeID for Win? If I use readelf I get this result Код (Text): ELF Header: Magic: 7f 45 4c 46 01 01 01 03 00 00 00 00 00 00 00 00 Class: ELF32 Data: 2's complement, little endian Version: 1 (current) OS/ABI: UNIX - Linux ABI Version: 0 Type: EXEC (Executable file) Machine: Intel 80386 Version: 0x1 Entry point address: 0xc286b0 Start of program headers: 52 (bytes into file) Start of section headers: 0 (bytes into file) Flags: 0x0 Size of this header: 52 (bytes) Size of program headers: 32 (bytes) Number of program headers: 2 Size of section headers: 40 (bytes) Number of section headers: 0 Section header string table index: 0 <corrupt: out of range> There are no sections in this file. There are no sections in this file. Program Headers: Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align LOAD 0x000000 0x00c01000 0x00c01000 0x27e14 0x27e14 R E 0x1000 LOAD 0x000c00 0x08146c00 0x08146c00 0x00000 0x00000 RW 0x1000 There is no dynamic section in this file. There are no relocations in this file. There are no unwind sections in this file. No version information found in this file. So file is packed with unknown protector. 2. Disassm Код (Text): LOAD:00C286B0 ; --------------------------------------------------------------------------- LOAD:00C286B0 LOAD:00C286B0 public start LOAD:00C286B0 start: LOAD:00C286B0 call loc_C28887 LOAD:00C286B5 jmp short loc_C286C5 LOAD:00C286B7 ; --------------------------------------------------------------------------- Ok... trace trace trace... Код (Text): LOAD:00C287A3 loc_C287A3: ; CODE XREF: LOAD:00C287A0j LOAD:00C287A3 sub edi, [esp+2Ch] LOAD:00C287A7 mov edx, [esp+30h] LOAD:00C287AB mov [edx], edi LOAD:00C287AD mov [esp+1Ch], eax LOAD:00C287B1 popa ; return registers from stack LOAD:00C287B2 retn LOAD:00C287B3 ; --------------------------------------------------------------------------- And after RET: Код (Text): debug001:00C291EB add esp, 10h debug001:00C291EE debug001:00C291EE loc_C291EE: ; CODE XREF: debug001:00C291CAj debug001:00C291EE ; debug001:00C291CEj ... debug001:00C291EE mov eax, [ebp-18h] debug001:00C291F1 add [esi+4], eax debug001:00C291F4 sub [esi], eax debug001:00C291F6 jmp short loc_C29202 ... ... ... debug001:00C290C4 push eax debug001:00C290C5 sub ecx, ebx debug001:00C290C7 mov al, 5Bh debug001:00C290C9 jmp dword ptr [edi] ;hmmm Now I'm in debug section... trace trace trace.... And after jump... Код (Text): debug002:080A072C ; --------------------------------------------------------------------------- debug002:080A072C int 80h ; LINUX - sys_munmap debug002:080A072E popa debug002:080A072F retn debug002:080A072F ; --------------------------------------------------------------------------- Again popa... And I am in library. Library is static linked. Код (Text): ld_2.8.90.so:B7F8A7F0 ; --------------------------------------------------------------------------- ld_2.8.90.so:B7F8A7F0 mov eax, esp ld_2.8.90.so:B7F8A7F2 call near ptr unk_B7F8AA20 ld_2.8.90.so:B7F8A7F7 mov edi, eax Trace ... and finaly I think I'm on EP. Код (Text): debug004:08049D90 ; --------------------------------------------------------------------------- debug004:08049D90 xor ebp, ebp debug004:08049D92 pop esi debug004:08049D93 mov ecx, esp debug004:08049D95 and esp, 0FFFFFFF0h debug004:08049D98 push eax debug004:08049D99 push esp debug004:08049D9A push edx debug004:08049D9B push offset unk_80992D0 debug004:08049DA0 push offset unk_80992E0 debug004:08049DA5 push ecx debug004:08049DA6 push esi debug004:08049DA7 push offset unk_804FDC0 debug004:08049DAC call near ptr unk_8049880 debug004:08049DB1 hlt debug004:08049DB1 ; --------------------------------------------------------------------------- Maybe I'm wrong... But how to dump file on linux? I change bytes on 8049D90 to EB FE. Run program and do deatach. Run GDB, attach to program pid and do dump of section I can dump. I got string table and all code, but no library functions... How to dump this file in right way?
Memory look like Код (Text): 00c01000-00c02000 r-xp 00000000 08:01 472102 LOAD /home/danci/prog/prog 08048000-080a1000 r-xp 08048000 00:00 0 DEBUG004 080a1000-08147000 rwxp 080a1000 00:00 0 PROG b7de3000-b7de5000 rwxp b7de3000 00:00 0 DEBUG005 b7de5000-b7f3d000 r-xp 00000000 08:01 246510 /lib/tls/i686/cmov/libc-2.8.90.so b7f3d000-b7f3f000 r-xp 00158000 08:01 246510 /lib/tls/i686/cmov/libc-2.8.90.so b7f3f000-b7f40000 rwxp 0015a000 08:01 246510 /lib/tls/i686/cmov/libc-2.8.90.so b7f40000-b7f43000 rwxp b7f40000 00:00 0 DEBUG006 b7f43000-b7f58000 r-xp 00000000 08:01 246536 /lib/tls/i686/cmov/libpthread-2.8.90.so b7f58000-b7f59000 r-xp 00014000 08:01 246536 /lib/tls/i686/cmov/libpthread-2.8.90.so b7f59000-b7f5a000 rwxp 00015000 08:01 246536 /lib/tls/i686/cmov/libpthread-2.8.90.so b7f5a000-b7f5c000 rwxp b7f5a000 00:00 0 DEBUG007 b7f6d000-b7f6f000 rwxp b7f6d000 00:00 0 DEBUG008 b7f6f000-b7f89000 r-xp 00000000 08:01 228948 /lib/ld-2.8.90.so b7f89000-b7f8a000 ---p b7f89000 00:00 0 DEBUG002 b7f8a000-b7f8b000 r-xp 0001a000 08:01 228948 /lib/ld-2.8.90.so b7f8b000-b7f8c000 rwxp 0001b000 08:01 228948 /lib/ld-2.8.90.so bf877000-bf88c000 rwxp bffeb000 00:00 0 [stack] ffffe000-fffff000 r-xp 00000000 00:00 0 [vdso] I can dump only: Код (Text): 08048000-080a1000 r-xp 08048000 00:00 0 DEBUG004 080a1000-08147000 rwxp 080a1000 00:00 0 PROG
It is not public release so it is not good to share... I can sent it by email if you want. But please don't talk about target, ok?
danci >>But please don't talk about target, ok? Ok! Could you send me private message on this forum, please(e-mail) ?
