Common binary file analysis methods in Linux

 

When you get a binary file in UNIX but do not know what it is, you can use the following method to get this prompt:

1. First, try the strings command. For example, to get a binary file named CR1, you can:

$ Strings CR1 | more

There may be some descriptions of this CR1, which are all textual descriptions left in the program after compilation, so they may tell you what this file is.

For example, output:

$ Strings CR1 | more
% S % s-> % S % s (%. * s)
Version: 2.3
Usage: dsniff [-cdmn] [-I interface] [-s snaplen] [-F services]
[-T trigger [,...] [-r |-W SaveFile] [expression]
...
/Usr/local/lib/dsniff. Magic
/Usr/local/lib/dsniff. Services
...

Then we can know that CR1 is actually a dsniff command.

2. If this method does not help you, you can try:

$/Usr/CCS/bin/nm-P CR1 | more

For example, the following output is obtained:

CR1:
[Index] Value Size Type Bind Other Shndx Name
[180] | 0 | 0 | FILE | LOCL | 0 | ABS | decode_smtp.c
[2198] | 160348 | 320 | FUNC | GLOB | 0 | 9 | decode_sniffer

These are the names of the obj files that generate the binary file. These names will tell you the role of the binary file.

Similarly, if you want to check what static library files are called by binary files, you can use nm-Du cr1.

3. Of course, we can also use the dump command to obtain the selected part of any binary file.

$/Usr/ccs/bin/dump-c./cr1 | more

Dump command parameters:

-C Dump the string table

-C Dump the C ++ symbol table

-D Dump debugging information

-F Dump the header of each file

-H Dump the section header

-L Dump travel number information

-L Dump part of the dynamic and static Link Library

-O Dump the executable headers of each program

-R Dump relocation Information

-S: Dump the section content with hexadecimal Information

-T Dump symbol table.

4. You can use the file command to obtain the binary file information.

$ File cr1

5. If it is still unclear, we can use the ldd command.

$ Ldd cr1

For example, the output is:
...
Libsocket. so.1 =>/usr/lib/libsocket. so.1
Librpcsvc. so.1 =>/usr/lib/librpcsvc. so.1
...

Then we can know that this program is related to the network library, and we can know its approximate functions.

We can also use the adb command to get a binary file execution process.

For example:
$ Adb cr1
: R
Using device/dev/hme0 (promiscuous mode)
192.168.2.119-> web tcp d = 22 S = 1111 Ack = 2013255208
Seq = 1407308568 Len = 0 Win = 17520
Web-> 192.168.2.119 tcp d = 1111 S = 22 Push Ack = 1407308568

We know that this program is a sniffer.

6. If you are sure you want to run this program, you can first pass:

        $ truss -f -o cr.out ./cr1
        listening on hme0
       ^C
        $

The truss command can help you open the system signal and call the output. you can know what the program is doing.

With these tools, we can probably find out what an unknown binary program is doing.

Finally, we will remind you that running unknown binary programs has serious security problems. Please be careful.