Reversing
bh_asmgrep
With the binary attempts to find instruction asm and print 4 lines around.
Note
Usage
bh_asmgrep`
[ asm instruction ] [ binary path ]
$ bh_asmgrep mov /bin/ls
....
....
....
--
409f2e:66 90 : xchg %ax,%ax
409f30:80 7c 13 ff 2f : cmpb $0x2f,-0x1(%rbx,%rdx,1)
409f35:48 8d 42 ff : lea -0x1(%rdx),%rax
409f39:75 08 : jne 409f43 <__sprintf_chk@plt+0x7783>
409f3b:48 89 c2 : mov %rax,%rdx
409f3e:48 39 d5 : cmp %rdx,%rbp
409f41:75 ed : jne 409f30 <__sprintf_chk@plt+0x7770>
409f43:48 83 c4 08 : add $0x8,%rsp
--
.....
.....
.....
bh_asminfo
Display information of instructions asm internet is required for help us.
Note
Usage
bh_asminfo
[ asm instruction ]
$ bh_asminfo mov
mov
|Code |Mnemonic |Description |
|88 / r |MOV r/m8, r8 |Move r8 to r/m8 |
|89 / r |MOV r/m16, r16 |Move r16 to r/m16 |
|89 / r |MOV r/m32, r32 |Move r32 to r/m32 |
|8A / r |MOV r8, r/m8 |Move r/m8 to r8 |
|8B / r |MOV r16, r/m16 |Move r/m16 to r16 |
.......
.......
.......
bh_replacestring
Find and replace string occurrence in the file, attention: the original file will be replacede by the new generated file.
Note
Usage
bh_replacestring
[ file ] [ string to search ] [ string to replace ]
$ hexdump -C MB_DEV
.......
00000690 2e 00 54 00 58 00 54 00 2e 00 00 00 73 00 77 00 |..T.X.T.....s.w.|
000006a0 e5 45 53 54 45 54 7e 31 53 57 58 20 00 65 a1 9b |.ESTET~1SWX .e..|
000006b0 8b 54 8b 54 00 00 a1 9b 8b 54 00 00 00 00 00 00 |.T.T.....T......|
000006c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00005e00 4d 65 6e 74 65 42 69 6e 61 72 69 61 0a 00 00 00 |MenteBinaria....|
00005e10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
$ bh_replacestring MB_DEV MenteBinaria BinariaMente
$ hexdump -C MB_DEV
.......
00000690 2e 00 54 00 58 00 54 00 2e 00 00 00 73 00 77 00 |..T.X.T.....s.w.|
000006a0 e5 45 53 54 45 54 7e 31 53 57 58 20 00 65 a1 9b |.ESTET~1SWX .e..|
000006b0 8b 54 8b 54 00 00 a1 9b 8b 54 00 00 00 00 00 00 |.T.T.....T......|
000006c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00005e00 42 69 6e 61 72 69 61 4d 65 6e 74 65 0a 00 00 00 |BinariaMente....|
00005e10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
bh_zerostring
Replace with zero bytes in block or common file.
Note
Usage
bh_zerostring
[ file ] [ string to replace ]
# hexdump -C MB_DEV
.....
00005860 41 4d 00 42 00 2d 00 66 00 69 00 0f 00 a1 6c 00 |AM.B.-.f.i....l.|
00005870 65 00 2e 00 74 00 78 00 74 00 00 00 00 00 ff ff |e...t.x.t.......|
00005880 4d 42 2d 46 49 4c 45 20 54 58 54 20 00 41 26 be |MB-FILE TXT .A&.|
00005890 69 54 69 54 00 00 26 be 69 54 05 00 1b 00 00 00 |iTiT..&.iT......|
.....
# bh_zerostring MB_DEV MB-FILE
7+0 records in
7+0 records out
7 bytes copied, 7.3484e-05 s, 95.3 kB/s
# hexdump -C MB_DEV
.....
00005860 41 4d 00 42 00 2d 00 66 00 69 00 0f 00 a1 6c 00 |AM.B.-.f.i....l.|
00005870 65 00 2e 00 74 00 78 00 74 00 00 00 00 00 ff ff |e...t.x.t.......|
00005880 00 00 00 00 00 00 00 20 54 58 54 20 00 41 26 be |....... TXT .A&.|
00005890 69 54 69 54 00 00 26 be 69 54 05 00 1b 00 00 00 |iTiT..&.iT......|
.....
# mount -o loop -t vfat MB_DEV /mnt/
# ls -la /mnt/
total 16
drwxr-xr-x 2 root root 16384 Dec 31 1969 .
drwxr-xr-x 1 root root 152 Feb 17 15:21 ..