-
Notifications
You must be signed in to change notification settings - Fork 258
Open
Copy link
Labels
Component: BinaryViewTypeEffort: LowIssues require < 1 week of workIssues require < 1 week of workFile Format: ELFImpact: LowIssue is a papercut or has a good, supported workaroundIssue is a papercut or has a good, supported workaround
Description
A classic technique for obfuscating an x86 ELF file is to change the endianness bit in the header to large endian. This will throw off binja's ELF parsing, but the binary runs just fine because the bit is not checked in common x86 Linux distros.
While manually patching the byte is an easy enough solution, I would recommend we:
- Check the machine field of the ELF header, and if it indicates x86, then the endianness should be overridden with little-endian
- Over to manually specify the endianness via open with options
Binary: laminar ice routes willingly
Copilot
Metadata
Metadata
Assignees
Labels
Component: BinaryViewTypeEffort: LowIssues require < 1 week of workIssues require < 1 week of workFile Format: ELFImpact: LowIssue is a papercut or has a good, supported workaroundIssue is a papercut or has a good, supported workaround