Introduction to problem: I have a binary executable with an unknown network packet protocol. I want to reverse engineer this packet protocol. My current way of doing it is to send some data and step through the instructions in disassembly to try to figure out what the application is doing with this data, and gradually construct the correct protocol. This solution is extremely inefficient. So I want to automate at least a part of this process.

Assuming that my network receive function is: int recv(SOCKET s, char * buf, int len, int flags);

What I want to do is to automate instruction tracking for all instructions reading the chunk of memory pointed by char * buf

mov eax, [globalRecvBufferPointer]
mov dl, [eax]
cmp dl, 20h
jz somewhere

In the example above, I want my automated tool to detect mov dl, [eax] and cmp dl, 20h instructions.
Adding a hardware r/w breakpoint to char * buf lets me detect mov dl, [eax] but not the other.
Another problem I can think of at this stage is when memory pointed by char * buf is copied to stack or other memory locations.

Are there ready-made tools for this kind of operation? If not, are there tools where I can implement this idea?

  • Isn't this impossible in the general case? Like if it do add dl, 1 and cmp dl, 21h — there's always the option of decompiling the program and just look at the source, what's the issue with that?
    – user202729
    Dec 11, 2021 at 1:42
  • @user202729 What I described can be done manually and is what I currently do. I'm currently looking into dynamic binary instrumentation frameworks which might be the tool that can help me implement this idea.
    – AcarX
    Dec 11, 2021 at 2:26
  • If the instruction has that exact format it's possible to use gdb Python scripting to parse the assembly listing or something.
    – user202729
    Dec 11, 2021 at 3:28
  • 1
    Unicorn Engine may be of interest; I've used it to emulate functions within a running program, but I've never tried to inject it into someone else's program...should be about the same. Major issue will be handling system calls. You'll have to set breaks to drop out of unicorn, actually run the call, then poke the results back into the emulated state. Unicorn has built-in memory access hooks. As an alternative, I posted complete code to remote-control GDB here (warning, slow!) Dec 12, 2021 at 2:49

1 Answer 1


Sounds like you want dynamic taint analysis. There is a well-supported, open-source option called Panda. If you have money to spend, check out the commercial offering Reven.

  • Reven releases free editions recently. Otherwise, implementing dynamic taint analysis with help of some DBI tools would be fun. Dec 17, 2021 at 9:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.