0

What I want to know is that is there any similarity or may be difference between a binary instructions and an execution instruction of a binary ?

In other world, in area of malware analysis a binary can be examined in both static and dynamic analysis. In static its instructions will be extracted without executing it while in dynamic the instructions will be extracted during execution of a binary.

If I want to clarify my question, I want to examine a binary(every binary even not malware) by comparing outputs of static and dynamic analysis in the fine grained level(instructions). But there are two problem for me! At first is it possible to compare these two outputs and how can I do that(do these two output belong to the same category that make the comparison possible)? As I saw the instructions output of dynamic and static analysis contain lots of instruction(very large output) so I am not sure can I compare them or not? and if it possible do I need multipath dynamic analysis to perform precise comparison?

Improve this question
1
  • If there is no obfuscation or code generation, then what will be actually dynamically executed was what was statically present in the malware.
    – Ange
    Oct 3, 2014 at 8:34

1 Answer 1

Reset to default
1

Malware executable can be self-modifying or packed. Using dynamic analysis may be a good shortcut to extract really executed code.

Generally position independent and not specially modified instructions should be exactly the same. Addresses of functions can be different because of ASLR or as a result of loader actions.

Improve this answer
1
  • Thanks. So if I assume a malware or a sample binary does not include any packer, obfuscation and so on, how can I compare these two output together and find similarities? Also should I perform multi path analysis for dynamic??
    – user2942756
    Oct 2, 2014 at 17:14

Not the answer you're looking for? Browse other questions tagged or ask your own question.