4 ms·

Ok, grep is a misnomer, but can we assume it was named binless and talk about the merits of this tool? It looks super useful. I can see how it fills a gap. I a

by Iv 9y ago

Ok, grep is a misnomer, but can we assume it was named binless and talk about the merits of this tool? It looks super useful. I can see how it fills a gap. I am not very often examining binaries, so I can be wrong about it but am i wrong in assuming that objdump will simply list the parts it manages to interpret from a file and silently ignores gibberish or unsupported sections? I have alway wanted an ability to examine a binary files in a way a bit more interpreted than an hex editor, but without missing any "gibberish" part. I can see that tool as a nice addition to a binary forensics toolbox

thethirdone 9y ago
In the case that you are interested, I made a tool for editing ELF files by hand (https://github.com/TheThirdOne/elf-edit https://github.com/TheThirdOne/elf-edit). It is hardly complete, but it does highlight section headers (and decode them into human readable format). One of the next features I want to implement is to skip to the section body, but I haven't had much time to work on it recently so it got put on the backburner. Also, I realized while writing this that the repo doesn't have a readme, so if you want to check it out you'll have to install it. If you are interested, I might be able to make a decent readme tomorrow.
- Iv 9y ago
  Thanks
- mmjaa 9y ago
  Does it do .NOTEs?
  - thethirdone 9y ago
    .notes aren't standardized so I don't know of a good strategy to highlight and decode them. IIRC .note.gnu.build-id is just ascii text so it should be pretty easy to understand anyway. I would think many others are also just text, but I don't know much about .notes in general because I was focusing on standardized, general ELF stuff.
    - mmjaa 9y ago
      Well, .notes are standard ELF .. the reason I'm asking is because .notes are for vendors, and well .. this seems like a tool-of-interest to vendors, y'know ..
- mmjaa 9y ago
  Does it do .NOTEs?
mfukar 9y ago
> I can see how it fills a gap What gap is that? I can't see anything I wouldn't find in existing tools. If all it offers is a prettifier, I'd rather it were just that.
- wruza 9y ago
  I can't see the gap too. Objdump, otool or nm with grep is what binary explorer needs. Rather than colorizing, why not filter unneeded things or colorize needed via search highlighting? (My personal preference, ofc.) From its very short source it seems that it simply pretty-prints headers of MachO and ELF files. No sophisticated logic involved, just hello world in rust. So it cannot be a prettifier, since it doesn't parse any output.
- Iv 9y ago
  I am not doing binary forensics regularly but I was under the impression that there is no tool that would display all the sections of a binary, with the insurance it would not skip a part it could not interpret? Maybe there are options of objdump I am ignoring there?
  - shakna 9y ago
    Maybe: readelf -a [0] [0] https://sourceware.org/binutils/docs/binutils/readelf.html https://sourceware.org/binutils/docs/binutils/readelf.html
falsedan 9y ago
> Ok, grep is a misnomer, but can we assume it was named binless and talk about the merits of this tool? The name of the tool is part of the tool, and part of using it will be for me to share it with other people & explain, it's called bingrep by it's not like grep (despite what the project readme says). People who are busy may see that as a signal that the project values communication lower than features, or that they made a mistake and either: know they did but choose not to acknowledge/act to fix it; or don't recognize it (how many other mistakes might they have made? Any which affect its operation?) Like this is the impression a colleague might get when spending 5 seconds listening to me mention it to them when getting a fresh coffee refill from the office kitchen.
- coldtea 9y ago
  tl;dr; name is important, we'd rather discuss it than the actual features on offer, lest somebody else gets confused by it.
  - falsedan 9y ago
    tl;dr my comment? You missed it: attitudes towards superficial stuff (like naming/accessibility/documentation) are used as proxies for important stuff (features, support, community) by people who don't have time to evaluate every possible product (busy engineers + management who can sign purchase orders).

by Iv 9y ago

thethirdone 9y ago

In the case that you are interested, I made a tool for editing ELF files by hand (https://github.com/TheThirdOne/elf-edit https://github.com/TheThirdOne/elf-edit). It is hardly complete, but it does highlight section headers (and decode them into human readable format). One of the next features I want to implement is to skip to the section body, but I haven't had much time to work on it recently so it got put on the backburner. Also, I realized while writing this that the repo doesn't have a readme, so if you want to check it out you'll have to install it. If you are interested, I might be able to make a decent readme tomorrow.

Iv 9y ago
Thanks
mmjaa 9y ago
Does it do .NOTEs?
- thethirdone 9y ago
  .notes aren't standardized so I don't know of a good strategy to highlight and decode them. IIRC .note.gnu.build-id is just ascii text so it should be pretty easy to understand anyway. I would think many others are also just text, but I don't know much about .notes in general because I was focusing on standardized, general ELF stuff.
  - mmjaa 9y ago
    Well, .notes are standard ELF .. the reason I'm asking is because .notes are for vendors, and well .. this seems like a tool-of-interest to vendors, y'know ..
mmjaa 9y ago
Does it do .NOTEs?

mfukar 9y ago

> I can see how it fills a gap What gap is that? I can't see anything I wouldn't find in existing tools. If all it offers is a prettifier, I'd rather it were just that.

wruza 9y ago
I can't see the gap too. Objdump, otool or nm with grep is what binary explorer needs. Rather than colorizing, why not filter unneeded things or colorize needed via search highlighting? (My personal preference, ofc.) From its very short source it seems that it simply pretty-prints headers of MachO and ELF files. No sophisticated logic involved, just hello world in rust. So it cannot be a prettifier, since it doesn't parse any output.
Iv 9y ago
I am not doing binary forensics regularly but I was under the impression that there is no tool that would display all the sections of a binary, with the insurance it would not skip a part it could not interpret? Maybe there are options of objdump I am ignoring there?
- shakna 9y ago
  Maybe: readelf -a [0] [0] https://sourceware.org/binutils/docs/binutils/readelf.html https://sourceware.org/binutils/docs/binutils/readelf.html

falsedan 9y ago

> Ok, grep is a misnomer, but can we assume it was named binless and talk about the merits of this tool? The name of the tool is part of the tool, and part of using it will be for me to share it with other people & explain, it's called bingrep by it's not like grep (despite what the project readme says). People who are busy may see that as a signal that the project values communication lower than features, or that they made a mistake and either: know they did but choose not to acknowledge/act to fix it; or don't recognize it (how many other mistakes might they have made? Any which affect its operation?) Like this is the impression a colleague might get when spending 5 seconds listening to me mention it to them when getting a fresh coffee refill from the office kitchen.

coldtea 9y ago
tl;dr; name is important, we'd rather discuss it than the actual features on offer, lest somebody else gets confused by it.
- falsedan 9y ago
  tl;dr my comment? You missed it: attitudes towards superficial stuff (like naming/accessibility/documentation) are used as proxies for important stuff (features, support, community) by people who don't have time to evaluate every possible product (busy engineers + management who can sign purchase orders).