4

Say I have a collection of N executables, where N is large enough to make repetitive manual analysis tedious. I want to process all of these files and extract information about certain function calls, for instance from a malware analysis point of view, knowing what constant arguments were used in calls to OutputDebugString would be of interest, and I guess for vulnerability research there may be applications, e.g. format strings.

A dynamic approach would be easiest, but has issues with code coverage and overheads when dealing with malware. I'd prefer a static approach and would be interested if anyone had any experiences to share. I was thinking along the lines of scripting IDA/HexRays to run over each binary, attempt to produce a C file and grep over the output, but this may be rather inefficient.

4

I wish I had an easy way to help you. When I did something similar previously, I used distorm and pefile. Basically, the approach I took in my code (and it, admittedly, wasn't a great one) was to:

  1. Walk the IAT of the executable to locate the function(s) of interest.
  2. Perform a recursive-descent disassembly of the executable looking for calls to that function.
  3. Use the recently disassembly instructions to check what the arguments were.

In retrospect, learning the IDA scripting would have saved me a lot of time and effort but I was hard-headed. If you're going to go down the same route, I'd suggest scripting IDA. Although, I'm not sure you need to use Hex-Rays to convert it back to C code first.

| improve this answer | |
  • Interesting, thanks - hadn't considered distorm. Hex-Rays was attractive due to its data flow tracking; there may be cases (e.g. variable re-use in arguments for repeated function calls) that could be less easy to analyze through pure disassembly. – user1307 Mar 29 '13 at 19:26
  • Yes, there were some edge-cases that required manual analysis from my end. But my corpus of executables was large enough that this technique worked for me for what I needed. I was only looking for an 80% solution at the time. – mrduclaw Mar 29 '13 at 21:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.