1

How does one extract the static API sequences of a PE file? I don't mean the imports listed in the imports segment.

I am currently using different RE tools like Ghidra, IDA Pro, and Binary Ninja. None of which I know has a built-in feature which allows me to extract the static API sequences.

[EDIT] I am looking for API call sequences without executing the binary. For example, maybe if the binary code contains file operations like fopen() → fwrite() → fclose() → fopen() → fwrite() → fclose(). I want to be able to extract this sequence of APIs.

Improve this question
4
  • Can you elaborate? Do you want to find API call sequences, like CreateFile -> WriteFile -> CloseFile?
    – Johann Aydinbas
    Commented Feb 1, 2020 at 15:16
  • @SarahChua: without running the binary how would you resolve all the conditions that may be used in between? E.g. fwrite() may only be called if some condition holds true or may only ever read a particular location under such condition. Could you elaborate what you want to achieve? In particular why is the sequence interesting? I can definitely see the charm of being able to see (external) library calls from a particular basic block/function. What does the sequence give you, when you know you can't properly get the sequence without certain runtime information.
    – 0xC0000022L ♦
    Commented Mar 4, 2020 at 8:15
  • Let me give an example. Say you have a particular function. You have a function with fopen(), about four dozen calls to fwrite() and an fclose(). Now if one of the fwrite() calls fails, I'd expect to land in the final fclose(). Additionally half of the fwrite() calls may represent a different "mode" of sorts, compared to the other half. So depending on a function argument you'd either end up calling one or the other. Your proposed "sequence of calls" metric doesn't tell you anything about it. So what's the purpose and why does the sequence matter?
    – 0xC0000022L ♦
    Commented Mar 4, 2020 at 8:19
  • @0xC0000022L I was reading the following paper [here] (sciencedirect.com/science/article/pii/S016740481831246X) and in the abstract, it says it utilizes static API sequences as part of the input.
    – nidorinas
    Commented Mar 5, 2020 at 14:06

1 Answer 1

Reset to default
1

That should be rather easy to solve in IDA with IDAPython or IDC.

I remember plugins that name functions based on API calls happening inside for a quick overview, one example here:

Finding all API calls in a function

Essentially it does what you need but note there is no semantic check whatsoever. It just means these API calls appeared in the same function and could be entirely unrelated, but it gives a rough overview of API call chains happening together (by logic of being in the same function).

If relation is important, it's a way harder problem as you'd need to track input/output from API calls (and for that know what the input/output for each API call is) and thus turning into a data flow analysis problem.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.