3

I have an idea to merge static and dynamic analysis into a visualization through the IDA python scripting interface. The concept involves automatically setting breakpoints at each function or basic block (configurable), automatically stepping through them while capturing the trace data at each point, and then presenting the program flow through a modified graph view. Perhaps even capturing diffs when alternate control flow paths are taken.

I'm not aware of any tools that currently do this but it seems like it could be highly useful in complex or obfuscated programs. Thoughts, issues, or comments?

  • From what I understand you want to do dynamic analysis to binary using emulator and add the result to static analysis result to enhance it (e.g. IDA static analysis) and because obfuscated programs may mislead the reverse engineer who use static analysis way most times this method will eliminate those tricks by add the result from the true executed binary in memory to static analysis result, and you can diff the two both assembly and graph, It seems Dynamic Binary Instrumentation can do that but why not use unicorn-engine to do that and add the result to IDA static analysis. – user22363 Aug 1 '18 at 15:18
  • 1
    github.com/deresz/funcap It seems very similar to what you want, more info about this plugin recon.cx/2014/slides/FunCap.pdf & hex-rays.com/contests/2013/index.shtml#funcap from the slide Funcap – features (2) Builds a runtime call graph | github.com/cseagle/sk3wldbg Debugger plugin for IDA Pro backed by the Unicorn Engine | github.com/36hours/idaemu idaemu is an IDA Pro Plugin - use for emulating code in IDA Pro. – user22363 Aug 1 '18 at 16:10
  • Yes, Dynamic Binary Instrumentation is where I'm looking at now. Funcap looks interesting, thanks. I think what I'm thinking about is a time-series view of a program being executed with API calls and function execution (in order) lined up. Previously, I was thinking about using IDA to extract the info from the debugger through scripting, but now I think that leveraging PIN or DynamoRIO would be far better. I'm thinking that the display I'm considering may need to be external to IDA. Grouping the DLL call series and the function call graph with: bl.ocks.org/cosmiclattes/6976316 – Shawn Aug 1 '18 at 20:11
  • I recommend you use PIN for Dynamic Binary Instrumentation + graphviz for visualization, also if you want Trace differences, like see the execution path your program took and look at the differences between two different executions you can use PIN + IDA look here doar-e.github.io/blog/2013/08/31/… – user22363 Aug 2 '18 at 1:33
  • I haven't worked with PIN before and I was hitting some build issues on my Linux VM yesterday. Still working through setup issues, likely associated with gcc. For the moment I have to go outside of IDA due to demo license restrictions. Looking for something a little more interactive than graphviz. – Shawn Aug 2 '18 at 14:12
2

It seems what you're describing is, or at least very similar to, Dynamic Binary Instrumentation and there are a bunch of tools that do that. DynamoRIO, frida and Pin tool are three widely known tools that do just that.

If you'll be willing to use static instrumentation, angr is another great option.

  • It does seem like part of what i'm imagining has been done. Groovy. I could be wrong (I haven't played with those tools much, admittedly), but I didn't think that they provide a way to visualize the data flow down to the basic block level. Just text? – Shawn Jul 31 '18 at 19:57
  • You're probably right about visualization. I don't think that's where the majority of effort will be with such a tool, though. You should consider adding your desired visualizations to one of the existing tools (preferably with an easily extendable interface?). – NirIzr Jul 31 '18 at 20:01
  • Thanks for your thoughts. I agree, visualizations aren't sexy so that's not where the majority of effort would be. I was thinking about a tie-in w/ IDA. – Shawn Jul 31 '18 at 20:08
  • Some of those tools has some IDA integrations/plugins. I'm sure they'll appreciate any contribution. – NirIzr Jul 31 '18 at 20:09
3

The basic idea is not new and has been done several times before.

Probably the first working tool was Process Stalker by Pedram Amini.

IDA also has its own little-known tracing feature which can use any of the available debugging backends including PIN (somewhat outdated post about it is here).

One of the recent newcomers is Lighthouse which looks pretty nice.

You can even do some of what you describe with Cheat Engine and I’m sure there are many other tools I haven’t heard about.

However, there is always room for innovation remaining, so don’t let this stop you from making your own if you can’t quite find what you need.

  • Wow, Lighthouse looks great! I'm going to play with these tools and think on this topic some more to see what improvements are possible. Thank you. – Shawn Jul 31 '18 at 20:35
  • check also this old paper for some pretty pictures – Igor Skochinsky Jul 31 '18 at 21:01
  • Yep, I'm familiar w/ this work. – Shawn Jul 31 '18 at 21:08
  • Here's an evolving concept. A web-based front-end (with potential future integration w/ IDA) with a sliding time-scale (such as: bl.ocks.org/cosmiclattes/6976316) showing the DLL call stack heirarchy at each point in time while mapping to a function call graph showing node activity at the corresponding time. A time-series view of this information might be interesting... – Shawn Aug 1 '18 at 20:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.