Skip to content

Support automatically and manually override the endianness of an ELF file #7339

@xusheng6

Description

@xusheng6

A classic technique for obfuscating an x86 ELF file is to change the endianness bit in the header to large endian. This will throw off binja's ELF parsing, but the binary runs just fine because the bit is not checked in common x86 Linux distros.

While manually patching the byte is an easy enough solution, I would recommend we:

  1. Check the machine field of the ELF header, and if it indicates x86, then the endianness should be overridden with little-endian
  2. Over to manually specify the endianness via open with options

Binary: laminar ice routes willingly

Metadata

Metadata

Assignees

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions