6

I am told that tools like IDA Pro are static disassembly tool, and tools like OllyDbg are dynamic disassembly tool.

But from the using experiences on these tools, I don't think there is any difference between the tools in disassembly procedure.

Basically all you need to do is load binary file into IDA or OllyDbg, and they will use certain recursive disassembly algorithm to disassembly the binary and give you the output.

Am I wrong..? Then what is the difference between static disassembly and dynamic disassembly..?

Thank you!

Improve this question
2
  • 3
    Aren't you talking instead of "static analysis" versus "dynamic analysis" ?
    – jvoisin
    Commented Jan 17, 2014 at 19:55
  • 1
    And look, there are even tag wikis static-analysis and dynamic-analysis that may or may not have extra information, depending on whether someone sat down to do it.
    – 0xC0000022L ♦
    Commented Jan 18, 2014 at 13:57

2 Answers 2

Reset to default
16

You have a mix up here. There is no such thing as dynamic disassembly and static disassembly but rather dynamic

Dynamic program analysis is the analysis of computer software that is performed by executing programs on a real or virtual processor.

and static analysis of a binary.

Static program analysis is the analysis of computer software that is performed without actually executing programs

What do the mentioned tools have are different disassembly engines which sometimes produce different results, mainly from binaries which incorporate anti-disassembly techniques.

Improve this answer
1
  • 1
    Yes, I think I have made the mistake before, now I know it and thank you a lot!
    – lllllllllllll
    Commented Jan 18, 2014 at 15:32
7

I actually don't think that there was any mix up. In fact, there exist two disassembly techniques : static & dynamic. The definitions provided here come from this 2003 publication on code obfuscation : http://www.cs.arizona.edu/solar/papers/CCS2003.pdf

  • Static disassembly is where the file being disassembled isn't executed during the course of disassembly.

  • Dynamic disassembly is where the file is being executed on some input and the execution is being monitored by an external tool (debugger, ...) to identify the instructions being executed.

This link (http://www.maqao.org/publications/madras_techreport.pdf) provides an interesting coverage of techniques used by some disassemblers & binary instrumenters. Though it is not exhaustive and doesn't directly answer your question, you'll find more references to check.

About dynamic & static binary analysis, these two techniques are mainly performed for profiling applications. The purpose is to acquire information about hot spots, memory access patterns, ...

  • The static analysis is usually based on analyzing the program without the need to execute it. It is mostly based on finding patterns, counting memory references, ... The Wikipedia page about Static program analysis is, from my point of view, incomplete but still a good read.

  • The dynamic analysis, on the other hand, involves executing the program and requires instrumentation of basic blocks such as loops, functions, ... The instrumentation consists of inserting probes at the entry and exit of a basic block which will measure the time according to a certain metric (CPU cycles, time in µs, ...). The information gathered after analysis is usually used to optimize the application by performing loop unrolling with a suitable unroll factor, vectorization if possible (SSE, AVX, Altivec, ...), etc.

Many tools perform both the latter techniques : Intel's VTune, MAQAO, DynInst, gprof, ...

I myself have written a GCC plugin, which you can find on my Github under the path /yaspr/zebuprof, which does instrumentation at the source level and performs static & dynamic analysis.

I hope this clarifies things a bit.

Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.