Using objcopy

I wanted to briefly touch on a tool called objcopy because it's a useful tool, even if we may not use it on every analysis we perform. This tool allows us to make a copy of a binary file, and if we choose, allows us to convert that binary file into one of many binary formats, including the ELF format. Additionally, if the need arises, we can use objcopy to strip symbols from a binary as we copy it. The primary use of objcopy that I've encountered is when we need to convert a binary into a raw format for use with the sc tool I mentioned in the previous chapter. Also, in case we've forgotten, sc comes installed by default in Kali Linux and works right out of the box. I have yet to find a way to get sc working properly on 32-bit Ubuntu Linux. Nonetheless, objcopy allows us to strip the ELF format from a binary and copy the raw format into another file for analysis using sc. This is one of the many really useful features of objcopy.

In our own binary analysis tasks, we always need to make sure we understand the potential damage tools can cause if we're not careful with the arguments we pass to the tool. The objcopy tool is no different. If we don't supply an output filename, the default behavior of this tool is to destructively overwrite the input file once any copying or transforming is completed. Please keep this in mind and commit it to memory. It's always a good idea to make a backup of the original binary before we begin analysis, just in case we accidentally mistype any arguments or options we supply to any command-line tool we use.

We will focus primarily on the objcopy tool, covering some of its more useful arguments, many of which will accomplish the same task as the tools we've already learned about. Remember, it's really not a bad thing to have more than one tool that can accomplish the same task. It all depends on your workflow and how you prefer to work through the analysis methodology. Hopefully, you're starting to get inspired to create your own workflow or automation.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
3.15.27.232