3

I have an idea to merge static and dynamic analysis into a visualization through the IDA python scripting interface. The concept involves automatically setting breakpoints at each function or basic block (configurable), automatically stepping through them while capturing the trace data at each point, and then presenting the program flow through a modified graph view. Perhaps even capturing diffs when alternate control flow paths are taken.

I'm not aware of any tools that currently do this but it seems like it could be highly useful in complex or obfuscated programs. Thoughts, issues, or comments?

Improve this question
6
  • From what I understand you want to do dynamic analysis to binary using emulator and add the result to static analysis result to enhance it (e.g. IDA static analysis) and because obfuscated programs may mislead the reverse engineer who use static analysis way most times this method will eliminate those tricks by add the result from the true executed binary in memory to static analysis result, and you can diff the two both assembly and graph, It seems Dynamic Binary Instrumentation can do that but why not use unicorn-engine to do that and add the result to IDA static analysis.
    – user22363
    Commented Aug 1, 2018 at 15:18
  • 1
    github.com/deresz/funcap It seems very similar to what you want, more info about this plugin recon.cx/2014/slides/FunCap.pdf & hex-rays.com/contests/2013/index.shtml#funcap from the slide Funcap – features (2) Builds a runtime call graph | github.com/cseagle/sk3wldbg Debugger plugin for IDA Pro backed by the Unicorn Engine | github.com/36hours/idaemu idaemu is an IDA Pro Plugin - use for emulating code in IDA Pro.
    – user22363
    Commented Aug 1, 2018 at 16:10
  • Yes, Dynamic Binary Instrumentation is where I'm looking at now. Funcap looks interesting, thanks. I think what I'm thinking about is a time-series view of a program being executed with API calls and function execution (in order) lined up. Previously, I was thinking about using IDA to extract the info from the debugger through scripting, but now I think that leveraging PIN or DynamoRIO would be far better. I'm thinking that the display I'm considering may need to be external to IDA. Grouping the DLL call series and the function call graph with: bl.ocks.org/cosmiclattes/6976316
    – Shawn
    Commented Aug 1, 2018 at 20:11
  • I recommend you use PIN for Dynamic Binary Instrumentation + graphviz for visualization, also if you want Trace differences, like see the execution path your program took and look at the differences between two different executions you can use PIN + IDA look here doar-e.github.io/blog/2013/08/31/…
    – user22363
    Commented Aug 2, 2018 at 1:33
  • I haven't worked with PIN before and I was hitting some build issues on my Linux VM yesterday. Still working through setup issues, likely associated with gcc. For the moment I have to go outside of IDA due to demo license restrictions. Looking for something a little more interactive than graphviz.
    – Shawn
    Commented Aug 2, 2018 at 14:12

2 Answers 2

Reset to default
3

The basic idea is not new and has been done several times before.

Probably the first working tool was Process Stalker by Pedram Amini.

IDA also has its own little-known tracing feature which can use any of the available debugging backends including PIN (somewhat outdated post about it is here).

One of the recent newcomers is Lighthouse which looks pretty nice.

You can even do some of what you describe with Cheat Engine and I’m sure there are many other tools I haven’t heard about.

However, there is always room for innovation remaining, so don’t let this stop you from making your own if you can’t quite find what you need.

Improve this answer
4
  • Wow, Lighthouse looks great! I'm going to play with these tools and think on this topic some more to see what improvements are possible. Thank you.
    – Shawn
    Commented Jul 31, 2018 at 20:35
  • check also this old paper for some pretty pictures
    – Igor Skochinsky ♦
    Commented Jul 31, 2018 at 21:01
  • Yep, I'm familiar w/ this work.
    – Shawn
    Commented Jul 31, 2018 at 21:08
  • Here's an evolving concept. A web-based front-end (with potential future integration w/ IDA) with a sliding time-scale (such as: bl.ocks.org/cosmiclattes/6976316) showing the DLL call stack heirarchy at each point in time while mapping to a function call graph showing node activity at the corresponding time. A time-series view of this information might be interesting...
    – Shawn
    Commented Aug 1, 2018 at 20:46
2

It seems what you're describing is, or at least very similar to, Dynamic Binary Instrumentation and there are a bunch of tools that do that. DynamoRIO, frida and Pin tool are three widely known tools that do just that.

If you'll be willing to use static instrumentation, angr is another great option.

Improve this answer
4
  • It does seem like part of what i'm imagining has been done. Groovy. I could be wrong (I haven't played with those tools much, admittedly), but I didn't think that they provide a way to visualize the data flow down to the basic block level. Just text?
    – Shawn
    Commented Jul 31, 2018 at 19:57
  • You're probably right about visualization. I don't think that's where the majority of effort will be with such a tool, though. You should consider adding your desired visualizations to one of the existing tools (preferably with an easily extendable interface?).
    – NirIzr
    Commented Jul 31, 2018 at 20:01
  • Thanks for your thoughts. I agree, visualizations aren't sexy so that's not where the majority of effort would be. I was thinking about a tie-in w/ IDA.
    – Shawn
    Commented Jul 31, 2018 at 20:08
  • Some of those tools has some IDA integrations/plugins. I'm sure they'll appreciate any contribution.
    – NirIzr
    Commented Jul 31, 2018 at 20:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.