Linux Binary Analysis for Ethical Hackers and Pentesters

Learn how a binary file contains machine code and is executable, unlike a text file; use file and objdump to identify and view machine instructions that run on the system.

Explains the binary compilation lifecycle from preprocessing to linking, showing how a C source becomes assembly, an object file, and a final executable through a practical hello.c example.

Learn to assemble a preprocessed source file into assembly code, inspect the hello world program in AT&T syntax, and prepare to convert the assembled code into an object file.

Create an object file with machine code from an assembly file via pre-processing and assembling, then use the compiler and linker to produce a binary executable.

Demonstrate how the linker takes an object file, attaches library addresses, and produces a binary executable with mapped addresses for execution.

Understand the ELF file structure by inspecting its hexadecimal bytes, grouped into executable header, program headers, sections, and section headers, with the executable header locating the rest.

Analyze elf header magic bytes in 64-bit binaries using read elf, map hex dumps to header fields, and understand entry point, program headers, and section headers.

Analyze the ELF header by examining program headers and section headers, noting counts 13 and 31 and the section header string table index 30, header sizes 64, 56, 64 bytes.

Clarify the difference between section headers and sections in an ELF binary, and show how to read section headers that index sections with addresses, sizes, and permissions.

Learn how ELF sections group code and data and how section headers index these chunks by address, offset, and size, using init and data sections as examples.

Learn to locate and view elf sections by inspecting section headers, counting 31 sections, and using objdump to disassemble specific sections like init, dot text, and dot data.

Learn how init and fini sections in ELF function as constructors and destructors, triggering code before main and after program exit, using objdump to inspect section contents.

Analyze the text section to reveal the actual executable code, including the main function. Use objdump to view the .text section and see how the start function calls main.

Analyze how the ELF data sections separate read-only, global, and initialized data, using objdump to inspect dot auto data, data, and dot basis sections.

Explore how elf plt and got sections resolve function addresses for dynamic linking, using a hello world example to show how puts in the library is located via the got.

Trace how gdb reveals the indirect call from main to the plt, then to the got, ultimately invoking puts and printing hello world.

Identify how the .rel.dyn and .rela.dyn sections store relocation addresses, revealing the linker and runtime addresses of library functions like puts for relocations at runtime.

Learn how the init array and fini array in ELF store pointers to constructors and destructors, enabling pre main initialization and post run cleanup of a binary.

Identify and describe the elf symbol table, dynamic symbol table, string table, and section header string table, and explain how to view them with readelf commands.

Learn to analyze a 64-bit ELF binary via hex dump cross-referencing, uncovering section headers, addresses, offsets, sizes, and flags in binary data.

Learn how ELF binary uses program headers to organize segments for dynamic linking and memory mapping, and how the loader uses segment permissions.

Identify a binary's type with the file command, decode base64 to reveal a zip, extract and analyze an elf binary and a png image, and obtain the secret key.

Investigate an elf binary using file, base64 decoding, and unzip to reveal hidden components. Extract the missing libconfidential.so with dd, export LD_LIBRARY_PATH, run the binary, and decode the secret message.

Show how to detect and extract hidden elf binaries inside a binary by locating elf magic bytes with a hex dump and grep, then dump and verify with readelf.

Compute the exact elf byte count from the section header start, header size, and section count. Extract the bytes precisely and verify with md5 hashes to match the original binary.

Identify printable characters in a linux binary using the strings tool to reveal hidden information such as passwords, messages, and function names.

Trace the elf binary's system calls with strace to see execve, write, and exit, as you assemble hello world and examine arguments and memory maps.

Analyze the disassembly of a binary to crack the crack me binary and reveal the secret password using object dump.

Learn how to perform dynamic analysis of strings in elf binaries using gdb, dump memory contents, set breakpoints, and trace registers to reveal the secret input during runtime.

Use gdb to perform dynamic disassembly of a Linux binary and compare it with static disassembly to reveal how runtime instructions exceed static dumps.

Explore static code injection in ELF binaries by patching a compiled program with hex dump and hex edit to redirect execution from main to the ABC function, illustrating binary analysis.

Learn how to perform code injection inside ELF binaries by overwriting nonessential sections, updating section and program headers, and altering the entry point with the ELF inject tool.