Skip to main content

All Questions

Tagged with
2 votes
1 answer
5k views

Can "missing section headers" ELF files still be executed/dangerous?

On VirusTotal, there are lots of ELF samples are missing section headers when using file command to see the info. Also, when using the Python elftools library to parse them, exceptions will be thrown....
I Wonder's user avatar
1 vote
1 answer
642 views

Disassembling Hexagon - Corrupted ELF

I downloaded and unpacked the modem from Google source, after that I used laginimaineb's script to unify all modem binary data. However, when loading this binary to IDA, I get an error says: Binary ...
loldev's user avatar
  • 111
1 vote
1 answer
2k views

objdump -T gives Invalid Operation on MIPS .so

I have a MIPS .so file that I'm trying to reverse. Binary Ninja (too cheap for IDA) finds no symbols, and neither does objdump -T, instead giving "Invalid Operation": % mips-linux-gnu-objdump -x ...
David's user avatar
  • 285
3 votes
1 answer
9k views

Address to file offset

I have read st_value from the ELF symbol table, with the value being 4195622. When converted to hex, the value is 400580. I am aware that the file offset is 580 bytes. My question is how to actually ...
Marius.pharoe's user avatar
3 votes
1 answer
3k views

Replace section inside ELF file

Is it possible to replace a non-code section inside an ELF file? If so, then how? Is there something I would have to consider before simply replacing the bytes by some other bytes (of course nothing ...
phk's user avatar
  • 115
1 vote
1 answer
939 views

Kernel dealing with the section headers in an ELF

I recently read that the kernel and the dynamic loader mostly deal with the program header tables in an ELF file and that assemblers, compilers and linkers deal with the section header tables. The ...
user avatar