+- Sinisterly (https://sinister.ly)
+-- Forum: Coding (https://sinister.ly/Forum-Coding)
+--- Forum: Coding (https://sinister.ly/Forum-Coding--71)
+--- Thread: Libs/tools to help reverse engineer custom binary file structs? (/Thread-Libs-tools-to-help-reverse-engineer-custom-binary-file-structs)
Pages:
1
2
Libs/tools to help reverse engineer custom binary file structs? - Bricker - 01-03-2022
My ADHD combined with ignorance, and a pinch of arrogance makes RE'ing binary files a massively tedious process and I'm sure I am working harder instead of smarter.
For the most part I just use a combo of my own scripts, Cutter, and Kaitai Struct IDE to do this, but it gets super tedious mapping, referencing, testing, guessing, etc. So I'm wondering if there is anything libs or tools to help speed up the process.
What I'd love is something that reads the file bytes and at least takes a stab at guessing obvious types. Stuff like bytes that look like they could reasonably be timestamps, arrays, etc. I've written a few shitty tools to help with this but I end up wasting a bunch of time on my code and not the file. Ya know, why spend time doing the actual work when you can waste even more time writing something to automate it
RE: Libs/tools to help reverse engineer custom binary file structs? - convector - 01-03-2022
Your ADHD and arrogance might get in the way but do you mind check these out?
https://web.cse.ohio-state.edu/~lin.3021/file/Rewards_NDSS10.pdf
https://blog.grimm-co.com/2020/11/automated-struct-identification-with.html
And also, can you share or do you perhaps know what the binary files written in what programming language?
RE: Libs/tools to help reverse engineer custom binary file structs? - Bricker - 01-03-2022
(01-03-2022, 10:14 AM)convector Wrote: Your ADHD and arrogance might get in the way but do you mind check these out?
Definitely ADHD, but these seem pretty interesting so I can probably make it through. I know Cutter integrates Ghidra (at least some of it), but I should probably spend some time with the actual Ghidra suite so I can give that GEARSHIFT script a go. Looks pretty damn cool.
Quote:And also, can you share or do you perhaps know what the binary files written in what programming language?
Mostly the files come from older smart devices so I'm guessing C, and possibly rust for some newer stuff. Kinda more obscure smart watches, dishwashers, etc.
RE: Libs/tools to help reverse engineer custom binary file structs? - convector - 01-04-2022
(01-03-2022, 03:59 PM)Bricker Wrote: Definitely ADHD, but these seem pretty interesting so I can probably make it through. I know Cutter integrates Ghidra (at least some of it), but I should probably spend some time with the actual Ghidra suite so I can give that GEARSHIFT script a go. Looks pretty damn cool.
Okay cool! That's seems nice. I guess you are a person of preference. Just explore more and I believe you will find what you are looking for.
(01-03-2022, 03:59 PM)Bricker Wrote: Mostly the files come from older smart devices so I'm guessing C, and possibly rust for some newer stuff. Kinda more obscure smart watches, dishwashers, etc.
Oh I see. I guess it's a job am I right? Rust is good stuff and kinda tough to reverse engineer. I have a favor to ask you, can you also explore binary files written with V Programming Language?
RE: Libs/tools to help reverse engineer custom binary file structs? - ConcernedCitizen - 01-04-2022
I regularly use Ghidra. Personally, it's my favorite. But there's a bit of a learning curve.
RE: Libs/tools to help reverse engineer custom binary file structs? - convector - 01-04-2022
(01-04-2022, 02:29 PM)vittring Wrote: I regularly use Ghidra. Personally, it's my favorite. But there's a bit of a learning curve.
Actually this is a bit true. But you know Ghidra or IDA PRO is very easy to use rather than the old school method where you get to use OllyDBG, Windows Tools and a bit of NirSoft if you have played around with that.
RE: Libs/tools to help reverse engineer custom binary file structs? - ConcernedCitizen - 01-04-2022
Strings, remnux, OllyDBG and many others. I still end up using the tried and true methods in Remnux and occasionally Kali Linux to get tools without having to configure everything myself every time I need to pick things apart. I also use a lot of Python and other languages like Ruby to help automate processes.
RE: Libs/tools to help reverse engineer custom binary file structs? - Bricker - 01-05-2022
(01-04-2022, 02:19 PM)convector Wrote: Oh I see. I guess it's a job am I right? Rust is good stuff and kinda tough to reverse engineer.
Kinda 50/50. I played around a bit on personal projects so that meant I had a little more than 0 experience, which made me the resident expert
Quote: I have a favor to ask you, can you also explore binary files written with V Programming Language?
Haven't done much with V but I could probably give it a go when I have some free time available.
RE: Libs/tools to help reverse engineer custom binary file structs? - convector - 01-05-2022
(01-05-2022, 12:49 AM)Bricker Wrote: Kinda 50/50. I played around a bit on personal projects so that meant I had a little more than 0 experience, which made me the resident expert
Oh at least you are somewhat like 50 in trying to choose a specific tool which makes life easier and 50 happy with what you are doing in my perspective.
(01-05-2022, 12:49 AM)Bricker Wrote: Haven't done much with V but I could probably give it a go when I have some free time available.
You should, it's kinda new, shortened version of Rust and has very fast compilation time.
RE: Libs/tools to help reverse engineer custom binary file structs? - fritz - 01-05-2022
+1 for Ghidra.
Although I'm pretty sure I don't use it at its full potential..
Any Ghidra tutorial/doc to recommend maybe?