Chapter 11
- A raw binary is a file that contains unprocessed data, so it has no format in any way while formatted binaries are binary files following a format specification such that they can be parsed, for instance, by Ghidra.
- If the file being analyzed follows a format specification, it is much more comfortable to let the loader automatically define the bytes as code or strings, create symbols, and so on. When dealing with raw binaries you will need to manually process the data. Therefore, it is much more confortable for a reverse engineer to deal with formatted binaries when possible rather than raw binaries.
- Old-style DOS executable is the format for MS-DOS executable binaries. The Ghidra loader for old-style DOS executable files is developed by the following pieces of software:
-
DOSHeader.java
: A Java file implementing the old-style DOS executable parser.-
OldStyleExecutable.java
: A class that usesFactoryBundledWithBinaryReader
to read data from a generic byte provider...