Questions tagged [dynamic-analysis]
Analysis of a piece of code by letting it run (fully or step-by-step) on a real system or in a virtualized environment, as opposed to static analysis.
142
questions
2
votes
1
answer
48
views
other than x32dbg, is there a more friendly way to check functions, their args and their return values on runtime?
atm I'm using ida and x32dbg, when I find a function that interests me, I set a breakpoint on x32dbg, however, I'm not good enough at assembly to know everything from a function just from looking at ...
- 23
3
votes
1
answer
101
views
How to reverse Engineer a Struct in IDA Pro?
How to identify and define a struct in IDA pro Decompiling during reverse engineering?
Please explain the easiest way to figure out the struct in IDA Pro decompilation!
To make life easier are there ...
2
votes
1
answer
36
views
In Pintool, How to find the name of an routine's caller?
I want to trace the mutex variables in my rust program(e.g. which mutex called lock() and unlock() methods). And I think there're static methods.
- 21
0
votes
0
answers
52
views
Why is Windows 10 still blocking me from running malware?
I am analyzing some malware on Windows 10. I installed FLARE VM, disabled tamper protection and disabled the virus scanner in the registry. However when I attempt to run a malware, Windows is still ...
- 131
2
votes
0
answers
32
views
How to re-create media file from android sender output stream
I would like to perform dynamic analysis on some android apps to check if these apps sending metadata with media files or not.
Ideas like the picture below:
Step 1: I prepared an image with metadata (...
- 121
3
votes
0
answers
51
views
Reverse engineering LCD memory map
I'm trying to get RAW data from a laser rangefinder device, but it has no PC connection ports. It has a small LCD screen onboard, where all data is displayed: distance, angle, battery level, etc. ...
- 131
5
votes
1
answer
233
views
Disassembling a DOS game with dynamic code/overlays in IDA Pro
I'm working on a disassembly of an old DOS game. (Real old: 16-bit, real mode.) The bulk of the game is in a large resource file of mixed binary and data; the executable basically just loads a chunk ...
3
votes
0
answers
144
views
Solved: Unable to hook Apple binary on iOS 14.x with Frida
I'm attempting to analyze a binary from iOS 14.8 (searchpartyd). I'm using Frida to try to hook it like I normally would with other binaries. However, I'm getting an error message that I'm unable to ...
- 31
3
votes
0
answers
51
views
Is there a Capturebat alternative on windows 10 for file capture?
I've been looking for a capturebat alternative that will function on Windows 10 and 64 bit.
I'm not interested in capturbat's network capabilities; rather, I'm interested in its capacity to capture ...
- 31
1
vote
1
answer
534
views
.NET: How to debug or decompile a DanamicMethod with dnSpy?
I have a managed .NET executable that supplies the msil bytecode of a function as raw bytes. It constructs a DynamicMethod object, sets the bytecode with DynamicMethod.DynamicILInfo.SetCode() and ...
- 423
0
votes
1
answer
109
views
Malware application in Android
Is there some website that give us the possibility to download malware APK in order to study it? I’m interested to study the abuse of android.permission.RECORD_AUDIO in Android 8.
- 37
1
vote
1
answer
301
views
How to debug a malware that does DLL injection into explorer.exe?
What steps would you suggest for debugging a malware that injects a DLL into explorer.exe?
using X32dbg
have already attached explorer.exe to x32dbg
- 11
3
votes
0
answers
41
views
Are there sampling profilers for stripped binaries?
I have a stripped binary in which I need to find the code for a particular function. I can run the binary on input which will make it spend a significant percentage of CPU time in that function. Maybe ...
- 131
1
vote
0
answers
74
views
How to get the call stack of WinAPI functions?
Yesterday, I noticed an answer to a question about the purpose of a certain undocumented function, which is a call stack (including the DLL library) for this function, This got me interested in the ...
- 15
0
votes
1
answer
133
views
How to find the first function that sets the value currently stored in a given register?
I'm interested in a general approach to the following problem:
The function F_Init allocates a byte buffer called Buffer with a size called BufSize. The Buffer is allocated with each frame/iteration ...
- 3
0
votes
1
answer
73
views
How to detect incorrectly named DLL?
I am trying a simple lab on malware analysis and we were given both an .exe and .dll file.
However, I am told that the DLL will need to be renamed to something for it to work.
How do I go about ...
- 1
1
vote
1
answer
61
views
how to bypass the instruction for antiDBI
This instruction stops the execution of the pin code jmp far 0x161061d, 0x33 ? how to get around this?
- 21
2
votes
0
answers
381
views
calculate memory address from IDA to use with Frida
I saw an interesting value in IDA at address 0xf8766; I want to view the value at that address.
I debug an Android application with Frida, how can I put this address in Frida to watch this value?
I ...
- 41
0
votes
1
answer
80
views
Dynamic instrumentation tool for injecting assembly
I'm not sure about all tools. But afaik at least with Frida functions are patched and new code is added to other memory regions and then jumped to. The rest of the code layout stays the same. Is there ...
- 1
2
votes
1
answer
850
views
How to call a func in an executable binary?
I have a binary with a func that I can disassemble. What are simple ways for me to call it with arbitrary args and observe its return val and behavior?
Ideally, I'd like to do this:
Within gdb (or ...
- 227
1
vote
1
answer
110
views
Adding ltrace information to gdb
I'd like to run gdb (or gdb-peda) with ltrace like info on each syscall. How can I do that?
I know that, as per ltrace and gdb attach to same process , you can't actually attach ltrace and gdb to the ...
- 227
0
votes
1
answer
200
views
PEDA: Don't show context
gdb-peda shows a very useful context each time it stops (b, si, etc.), but sometimes I don't want it. Is there any way to quiet it so it won't show the context automatically (unless prompted context)?...
- 227
1
vote
0
answers
41
views
Capturing created and deleted files from a Java file
I am new to the malware analysis field but I do have an issue, a file I am working on creates 2 vbs files, reads from them and deletes them, this all happens in around 2 seconds. Also this is a Java ...
0
votes
1
answer
3k
views
In x64dbg, how to set software breakpoint on specific memory address?
This is something I know how to do in Olly Debugger, and can't figure out how to do in x64dbg.
In Olly Debugger, it's possible to set a hardware or software breakpoint, either on access or on write, ...
- 115
1
vote
3
answers
1k
views
CaptureBAT equivalent on Windows 10?
Hello RE community on stack !
I am a beginner, so please pardon any commonplace errors
I am looking to run CaptureBAT on a Windows 10 VM, to capture network activity of different kinds of Malwares
I ...
- 111
0
votes
1
answer
140
views
Is it possible to make a dynamic memory allocated .data segment to static in a file?
Sorry if this is a dumb question I'm new to assembly.
Basically I want to modify a function in a .exe file to return with a different data, but my issue is that the memory location of the data segment ...
- 3
0
votes
0
answers
101
views
Pin DBI tool - Create executable
I'm starting to learn Intel's Pin framework and I can't figure out if it's possible to create an executable.
I mean, rather than creating a module and forcing people to download Pin + the module, is ...
- 1
0
votes
0
answers
35
views
Jumping to a specific logation for DLL injection : OllyDbg
Hypothetically, If I'm hijacking a DLL but user space is in a sandbox; upon debugging, sandbox initiates at 0x345678 and I want to move to the space before it initiates:
Can I call a jmp function ...
- 1
1
vote
0
answers
229
views
Dynamic Analysis with gdb on ELF binaries with no compilation/linking information
I am trying to do some dynamic analysis on a couple of ELF binaries with gdb. However, since those two are directly downloaded (ELF binary file only) with no additional information related to ...
- 11
0
votes
0
answers
155
views
Forcing embedded libcurl to disable SSL verification
I am trying to decrypt HTTPs communications in a binary that I know has been statically linked with cURL. How can I force curl to not verify SSL certificates for fiddler to intercept? I am using the ...
- 1
0
votes
2
answers
168
views
Is manually converting/decompiling x86 source code to C/C++/etc... considered reverse engineering?
I have the source code of an old program written in 32-bit x86 assembler that I am working on manually rewriting in C.
The first time someone asked me about this project I told them I was 'reverse ...
- 133
1
vote
1
answer
423
views
frida - The specified child already has a parent. You must call removeView() on the child's parent first when hooking, how do you solve it?
I wanted to hook the method A1f in the below code but frida returns the following exceptions:
Found instance: MyHomeFragment{9bbd8d5} (0965bca9-4838-4ca1-a835-d99639ae15f1)}
java.lang....
- 289
3
votes
0
answers
609
views
How can I practically approach VM-obfuscated code with symbolic analysis/execution?
Dealing with VM-obfuscated code and started learning about symbolic analysis but having a hard time wrapping my head around how to practically apply it to a problem. If someone can give me some ...
- 143
0
votes
1
answer
139
views
Debug process that use /dev/watchdog
I want to debug a process with gdb into Linux system, but the problem is that process pings /dev/watchdog so when I tried to debug it, it stop the process for longer than the watchdog interval so the ...
3
votes
1
answer
1k
views
Dynamic analysis (Frida) reveals instance of a class that doesn't exist in the source code (dex2jar)
I have been diving into an apk's source code, doing both static analysis with Jadx (same as dex2jar) and dynamic analysis with Frida.
I am trying to replicate the method that signs HTTP requests "...
- 33
1
vote
1
answer
371
views
Charles TLS Proxy for Android device with root access
I am trying to setup a TLS proxy with Charles proxy to man-in-the-middle an Android app. I would like to be able to view the contents of HTTPS traffic. This is not an app that I built, rather I am ...
- 161
1
vote
2
answers
826
views
Is frida-server latest version compatible with old Android versions
I'm trying to figure out, if it's appropriate to use frida-server latest version (12.8.x at the moment of writing this question), on any Android version (even the old ones like KitKat).
I'm asking ...
- 111
3
votes
0
answers
82
views
How to retrieve generically memory reads of an input and determine all relevant offsets?
I would like to record all memory read operations that are performed by an application on a given input file, to help infer which specific parts of an input are relevant for the specific execution ...
- 31
1
vote
1
answer
181
views
Get function return value
Any idea for more ways to get return value?
(No hooks, no hw/memory breakpoints, no call functions).
thx :)
I tried to find a dword maybe that hold the function return, but I didn't find it.
I'm ...
- 59
1
vote
1
answer
109
views
Android dynamic UI state inspection/profiling tool
I am looking after for a command-line tool that can perform dynamic view hierarchy analysis similar to the UI tool in Android Studio https://developer.android.com/studio/debug/layout-inspector.
Is ...
- 121
1
vote
1
answer
130
views
How to create an executable that keeps the same virtual address on different runs
I want to create an executable that keeps the same virtual address during different execution runs.
This is definitely possible because I've seen these files in CTFs(Capture the flag) where the ...
- 113
0
votes
1
answer
116
views
Break when exe send tcp packet
When I debug exe file with Ida I want to put breakpoint before the exe file send tcp packet.
When I listen with procmon I can see that this exe send and recive tcp packet.
1) I look on the exe file ...
- 31
0
votes
1
answer
184
views
x64dbgpy: application unresponsive when trying to automate inside breakpoint callback
When a breakpoint callback is triggered trying to automate the debugger inside the callback causes the application to become unresponsive. x64dbg continues functioning but the application itself doesn'...
- 103
3
votes
1
answer
897
views
Radare2 - How to debug Android native code (dynamic analysis)?
I'm using Termux(root) on LineageOS 16 (Android 9) with radare2 (v3.6.0 linux-arm32). When i attach to a process with 'r2 -d pid' the app freezes properly but doesn't continue with 'dc'. I'm not sure ...
- 173
0
votes
1
answer
5k
views
How do I find the address of a data location at runtime?
I'm using ghidra and cheat engine to reverse engineer a game's function. In ghidra's decompiler this function references two locations known as _DAT_XXX. I know the addresses of these locations in the ...
- 63
1
vote
0
answers
251
views
Reconstructing struct/union-based IPC protocol wire format
I'm embarking on my first reverse-engineering adventure. I think I've picked a rather dense piece of steak to start out with.
I have three C programs which communicate together using an unknown IPC ...
- 121
2
votes
1
answer
3k
views
Difficulty in debugging with dnSpy
I have a dotnet malware sample that I'm trying to debug with dnSpy. It has string obfuscation (contains function names such as BarriersBottomed, etc.) I cleaned the sample using de4dot and renamed ...
- 23
1
vote
1
answer
176
views
How can I know what the executable is missing to run?
I have extracted a presence of MZ file from memory which happen to be available in VirusTotal ( might be a malicious executable). However, I could not run the program. It seems to have some missing ...
- 11
0
votes
1
answer
4k
views
How to find functions in IDA Pro/x64dbg
i created a program for testing, very simple in c++.
is ask for password if it is match is print correct, if no it is print "bad".
i try to find with ida where is the function of what i made.
but i ...
- 59
1
vote
3
answers
654
views
Most efficient way to begin analyzing malware binary
I'm taking a reverse engineering course and the class has just been given a big project where we have to analyze a packed malware binary. I am using a Windows 10 VM. I am a little confused on where to ...
- 135