How to get machine code from binary file to use in Capstone?

[kcsmta]

I have some binary files which i want to disasemble. I've try Capstone. I now encounter some problems:

1. I dont know what's parameters hardware architecture and hardware mode of these binary file are (it is required by Capstone). I 've try binwalk with option --disasm, but it return something like "ARM executable code, 16-bit (Thumb), little endian, at least 778 valid instructions". Is there any way to get hardware architecture and hardware mode parameters from this to use in Capstone?
2. Capstone require only machine code. How to extract machine code from binary file? I've try objdump but it return "objdump: [binary_file_name]: File truncated", like this screenshot image. Here are the link contain some binary sample file.

[aquynh]

I have some binary files which i want to disasemble. I've try Capstone. I now encounter some problems:

1. I dont know what's parameters hardware architecture and hardware mode of these binary file are (it is required by Capstone). I 've try binwalk https://github.com/ReFirmLabs/binwalk with option --disasm, but it return something like "ARM executable code, 16-bit (Thumb), little endian, at least 778 valid instructions". Is there any way to get hardware architecture and hardware mode parameters from this to use in Capstone?

For binary blob, i dont know any public tool that can figure out the CPU arch + mode. But for legit file, you can look at fileformat and find out.

1. Capstone require only machine code. How to extract machine code from binary file? I've try objdump but it return "objdump: [binary_file_name]: File truncated", like this screenshot https://i.stack.imgur.com/lbvmb.png image. Here https://github.com/kcsmta/malware_sample are the link contain some binary sample file.

For legit file, such as ELF, PE, MachO, you need to understand the format to extract the code out. Find docs on these formats, and see how. Besides, it is good to look at sample projects to see how people did this.

[kcsmta]

@aquynh your answer is very useful. Error occurred when i run objdump means that these binary file is not legit?

[aquynh]

Maybe. You can confirm by running the same cmd on a legit Linux executable file.

[kcsmta]

@aquynh it got error: "cannot execute binary file: Exec format error" like this: but i think the reason is because i trying to run an executable compiled for an ARM architecture on an x86-64 architecture (when i run command file [file_name], i got the information: "ELF 32-bit LSB executable, ARM, version 1, statically linked, not stripped" like this . How to get machine code from these file? Plz give me some advices

[aquynh]

You need objdump for Arm, available in Arm toolchain.

Or it is easier to use other tools, like radare2, that supports everything.

[kcsmta]

@aquynh I'll try it. So many thanks!

[E3V3A]

Close?

[radare]

Y

On 23 Oct 2018, at 10:36, E:V:A notifications@github.com wrote:

Close?

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or mute the thread.