0
votes

Recently, I got my hands on a ELF executable intended for ARM-based microcontrollers. To my surprise, when I tried to inspect it by dumping everything with arm-none-eabi-objdump it kept failing with error

File format not recognized

Upon asking the person who supplied the binary, I learned that it's been compiled (and linked) with a proprietary toolchain, which I shan't mention as to avoid giving them extra publicity. Subsequently, I was told that I need utilities from the said proprietary toolchain in order to disassemble the binary. Now this is what got me curious. How is it possible for GNU's objdump to not parse the ELF file? To my knowledge, ELF is a standard free file format. Surely even if the instruction set is not recognised then it should be possible to at least obtain section and symbol table, as well as binary disassembly of the symbols. Perhaps the information is encrypted?

1

1 Answers

0
votes

Problably, the ELF header is somehow corrupted to enforce anti debug techniques. You can learn alot from crackme challenges. There is an x86 crackme by Jonathan Salwan which seems to do the same. You can read more about it in his blog article "A binary analysis, count me if you can": http://shell-storm.org/blog/A-binary-analysis-count-me-if-you-can/