Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [dynamic-analysis]

Analysis of a piece of code by letting it run (fully or step-by-step) on a real system or in a virtualized environment, as opposed to [tag:static-analysis]

0
votes
1answer
56 views

How can I know what the executable is missing to run?

I have extracted a presence of MZ file from memory which happen to be available in virustotal ( might be a malicious executable). However, I could not run the program. It seems to have some missing ...
0
votes
1answer
67 views

How to find functions in IDA Pro/x64dbg

i created a program for testing, very simple in c++. is ask for password if it is match is print correct, if no it is print "bad". i try to find with ida where is the function of what i made. but i ...
0
votes
3answers
170 views

Most efficient way to begin analyzing malware binary

I'm taking a reverse engineering course and the class has just been given a big project where we have to analyze a packed malware binary. I am using a Windows 10 VM. I am a little confused on where to ...
1
vote
0answers
26 views

Instrumentation fail when app use far jump 0x33 crash

Do you known any dbi tool that support instrumentation of application that use far jump 0x33? P.S. pin, dymanoRIO don't support far jump 0x33.
3
votes
1answer
545 views

Emulating Routers and other Embedded Devices with QEMU

I'm thinking about reverse engineering a few router models and trying to get them running with QEMU. In particular I'm trying to get the web server running. The current issue I'm thinking might be a ...
0
votes
0answers
32 views

Where should I hook more to analyze android Bluetooth communication?

I wanted to learn how other bluetooth applications connects bluetooth OBject EXchange Object Push Profile , as my app continuously threw famous errors socket might closed are timeout; read() ret : -...
4
votes
0answers
202 views

How do I perform concolic execution with Angr and collect constraints on input?

I have a program that takes a string (with some structure) as input. My aim is to collect information on what values each character in input is compared to as it gets parsed using concolic execution. ...
1
vote
1answer
134 views

What is ObjectStublessClientXX in ole32dll?

When I do dynamic reversing I saw usage with ObjectStublessClientXX in ole32.dll . What is that function? What does it do? Is there any way that it supposed to transfer message between 2 processes? ...
1
vote
2answers
85 views

How can I view in-memory strings of a process on Linux (Ubuntu)?

On Windows, I can use tools like Process Explorer and Process Hacker to view in-memory strings generated at runtime of a given process. How can I accomplish this same task on Ubuntu?
1
vote
1answer
127 views

How to watch communication between 2 processes?

I have exe file in my pc(exe1) that send message to another exe (client-server maybe). I dont know which exe recived this message from exe1 and with which iso that message encoding. How can I see ...
3
votes
2answers
180 views

Hybrid binary analysis tool

I have an idea to merge static and dynamic analysis into a visualization through the IDA python scripting interface. The concept involves automatically setting breakpoints at each function or basic ...
2
votes
1answer
82 views

Detect interesting testcases

Suppose I have a ton of test cases and my target is closed-source. Well, I need to know which test cases discover new path in the execution of my target and which are duplicated. I know I have to use ...
7
votes
1answer
163 views

How to detect internal and shared libraries used in an executable file?

Problem: We want to be able to tell with some certainty that specific versions of internal libraries are being used by a program. For example, if a software uses old, deprecated libraries internally. ...
1
vote
0answers
213 views

Hook function in Linux SO file

I'm working on reverse engineering an Android application where the native code opens TLS connections using a built-in copy of mbedtls with certificate pinning. I'd like to decrypt that traffic and ...
1
vote
1answer
336 views

bypassing anti-VM inside protected samples

This is a good starting point. As you know: Sandboxes and virtual environments (hypervisors) are full of artifacts that betray their analysis environment. Malware can protect itself against these by ...
-1
votes
1answer
399 views

Dynamic Analysis on ELF using IDA

On Linux, while generally reversing ELF files and dynamic analyzing (like step into, step over, break-point, inspecting registers value, memory etc) I use gdb or radare2 which provides dynamic ...
1
vote
1answer
363 views

Is it possible to set breakpoints relatively to the memory block in x64dbg or a similar debugger?

Some of my breakpoints perfectly survive multiple restarts. But many interesting parts of the code I am debugging have different locations in memory after a restart. It seems the reason is, that the ...
1
vote
2answers
90 views

Test malware files in host machine?

To analyze malware files we are using virtual machine and virtual box but some of malware detect the environment and will not do its work properly. I want to know how to test malware files with out ...
0
votes
1answer
236 views

How can I circumvent rdtsc when used as an anti-debugger technique?

I using x86dbg and am working on unpacking a target. The unpacking stub appears to be using some anti-debugging techniques - most of which I can detour with a plugin. However, there are a lot of ...
3
votes
1answer
433 views

No apparent entry point for stripped, PIE binary using radare2

I am running on 64-bit Windows 7 and am using radare2 to attempt both static and dynamic analysis of a binary executable. The issue is that I cannot seem to find the entry point of where the program ...
0
votes
1answer
101 views

Configuring a C&C for a RAT [closed]

Where would I start when needing to configure a command and control server for a RAT? So that my dynamic analysis can be more complete. Note: I have been to the topics section of this stack exchange....
0
votes
2answers
1k views

How to unpack and decrypt malware? [duplicate]

Recently I have been working on reverse engineering of binary samples and executables of known malware. Most of them have been packed or encrypted. And to reach the actual data or part of the program ...
4
votes
0answers
125 views

Define function in x64dbg

I am reversing a fairly complex app. In x64dbg (with xAnalyzer), is it possible to have custom function definitions? A simple example would be to have a definition for WinMain(hInstance, ...
3
votes
3answers
1k views

Exe protection by TLS callback, trying to understand the behaviour

I have an app, obfuscated by FSG protector. When i tried to unpack it, the first thign that i had is, when i start the process with the debugger/or attach debugger later, i immediatly receive ACCESS ...
4
votes
2answers
548 views

Dealing with instructions that are accessed by multiple pieces of data

So to gain more experience with reversing, I am currently trying to write an external hack for a video game called Borderlands 2. I've been using cheat engine to scan for addresses of instructions ...
0
votes
1answer
990 views

How can I dynamically debug a malicious DLL? [duplicate]

English isn't my first language, So I will do my best ) I am trying to analyze some malware NotPetya and I can run the malware by running : rundll32.exe notpetya.dll #1 I am using Olly and trying ...
1
vote
1answer
528 views

Could not find ld-linux-x86-64.so.2 in strace output

I did a ldd on /bin/cat and I see that dynamic loader library /lib64/ld-linux-x86-64.so.2 is a part of it. ldd /bin/cat linux-vdso.so.1 (0x00007ffe743f4000) libc.so.6 => /lib64/libc.so.6 (...
1
vote
1answer
1k views

IDA Pro debugging: follow child process

I'm reverse engineering a malware that creates a number of child processes and I'm trying to do dynamic analysis of the ELF binary with IDA Pro and IDA's Local Linux Debugger, but I can't get IDA to ...
0
votes
1answer
347 views

How to get better in re?

I'm a junior security researcher, and I'm interested in improving my ability in RE. I am a programmer at Assembly and C (and python and a few more high level lang). I learned and know how to use ...
1
vote
3answers
1k views

How to monitor/reverse engineer RS485-connected display device traffic?

Can anyone point me in the right direction for tutorials etc on reverse engineering RS484 connected battery management system? I have a large 12V lithium battery module which has an internal BMS and ...
0
votes
2answers
187 views

How to perform memory address translation on x86 instructions?

I have a mechanism that maps memory addresses to other memory addresses, e.g.: { 0x10000 -> 0xA0000 0x20000 -> 0x99000000 0x340000 -> 0x50000000 ; Stack in this example } Some example ...
4
votes
1answer
687 views

Analysis of SSL traffic from a Windows 10 application

I have to analyse SSL traffic of an executable under Windows 10. This sounds trivial really, why not just use Burp suite? Using Burp Using Burp I setup an invisible proxy listenning on port 443 and ...
0
votes
1answer
412 views

Dynamic Analysis Detection

Suppose you want to conceal an application's true purpose from analysts by reacting to dynamic analysis tools. How is it possible to detect running (in debugger mode) the application under a reverse ...
1
vote
1answer
420 views

Call Android method without running whole Android-App

I want to ask if somebody is aware of tools/projects which are similar to the Appcall feature of IDA Pro[1] for Android Apps? I'm looking for the possibility to run certain methods detected in the ...
1
vote
0answers
358 views

OllyDbg step over command not behaving exactly as the Immunity Debugger

I am taking Lena Reverse Engineering Tutorial and it uses OllyDbg debugger for its teaching. In the first chapter, he shows the file in OllyDbg debugger and steps over through it "step by step" until ...
0
votes
1answer
226 views

What is the relationship between the Windows API and the C run time library? [closed]

I have two reports of static and dynamic malware analysis. There are some APIs of MSVCRT's dll in my static report, which are missing in the dynamic report. (such as _p_commode, _setusermatherr, etc.) ...
5
votes
1answer
2k views

Unicorn and QEMU: Example use cases to understand the differences

The Unicorn website lists some differences between Unicorn and QEMU, especially those differences "where Unicorn shines". They furthermore write: A notable difference between Unicorn and QEMU is ...
1
vote
1answer
682 views

How to get the runtime memory region information when instrumenting using Pin?

I am using Pin for some execution monitoring tasks towards x64 ELF binary code. During the monitoring, for any memory write/read operation of the original code, I would like to record it as long as ...
3
votes
3answers
213 views

Dynamic instrumentation tools which support reverse execution

I am trying to analyze some execution crash information, and to better identify the root cause of memory access error, I would like to reverse execute the program from the crash point. For example, ...
2
votes
2answers
296 views

Dynamic analysis of malware samples

I have thousands of Linux malware samples in ELF format. And I am thinking to use dynamic analysis (say, PIN) to obtain an execution trace of each malware sample. However, I am afraid such activity ...
2
votes
1answer
512 views

Analyzing a Login Process

I am reverse engineering a program that uses a custom auth protocol. This is a basic outline of the process: Client takes input for username and password, then sends username to the auth server. Auth ...
0
votes
2answers
962 views

Configure and execute Intel's PIN Tool

I am trying to develop a Pintool on Windows. But so far I have been unable to configure or execute PIN. I have Microsoft Visual Studio 10.0 installed on my system. I have also downloaded and unzipped ...
1
vote
1answer
110 views

Different basic block count when running application several times

I've been testing DynamoRio and minblox to do coverage analysis, and I've got a question, when I run a the bbcount sample on ping.exe (not passing parameters) several times, I get different count of ...
0
votes
1answer
85 views

What is the difference between Intrusive Attaching and Non-Intrusive Attaching when debugging?

In Core Debugger Concepts What is the difference between Intrusive Attaching and Non-Intrusive Attaching when debugging?
1
vote
1answer
516 views

Variable's position on stack

I wanna create a script/program that will modify value in memory of another process. With GDB I've discovered that variable I want modify is located on heap. Because this variable is create ...
1
vote
1answer
119 views

Capstone Disassembly Engine Issue: OP_Access throws TypeError

After installing the Capstone python module, I ran this example on a Win7x86 PC with a minor edit (added arch and mode). However, when attempting to use insn.regs_access(), it throws a NoneType ...
0
votes
1answer
710 views

Any tips for analyzing this mips function

These function are used to decrypt with AES and there is Decrypt by CRC and I assume that crc is used for data checksums, I have qemu-mipsel and my question for u is how could I discover from where ...
2
votes
2answers
1k views

Generating call graph for assembly instructions

I'm writing a tool and I need to generate the callgraph for assembly instructions. But I do not know how to exactly generate call graph from assembly instruction. Do you have any idea? To clarify, I ...
9
votes
1answer
227 views

Saving program execution state for fuzzing

Suppose I have a program that has two functions, functionA and functionB called sequentially. functionA requires a significant amount of processing in order to execute, and in the course of the ...
1
vote
2answers
558 views

identify packer compression or encryption algorithm

I do have an executable packed file. I want to detect compression or encryption algorithm dynamic and static ways separatly; of course without signature base way. How can I detect compression or ...