Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [dynamic-analysis]

Analysis of a piece of code by letting it run (fully or step-by-step) on a real system or in a virtualized environment, as opposed to [tag:static-analysis]

3
votes
1answer
133 views

Emulating Routers and other Embedded Devices with QEMU

I'm thinking about reverse engineering a few router models and trying to get them running with QEMU. In particular I'm trying to get the web server running. The current issue I'm thinking might be a ...
0
votes
0answers
26 views

Where should I hook more to analyze android Bluetooth communication?

I wanted to learn how other bluetooth applications connects bluetooth OBject EXchange Object Push Profile , as my app continuously threw famous errors socket might closed are timeout; read() ret : -...
4
votes
0answers
81 views

How do I perform concolic execution with Angr and collect constraints on input?

I have a program that takes a string (with some structure) as input. My aim is to collect information on what values each character in input is compared to as it gets parsed using concolic execution. ...
1
vote
1answer
102 views

What is ObjectStublessClientXX in ole32dll?

When I do dynamic reversing I saw usage with ObjectStublessClientXX in ole32.dll . What is that function? What does it do? Is there any way that it supposed to transfer message between 2 processes? ...
1
vote
2answers
61 views

How can I view in-memory strings of a process on Linux (Ubuntu)?

On Windows, I can use tools like Process Explorer and Process Hacker to view in-memory strings generated at runtime of a given process. How can I accomplish this same task on Ubuntu?
1
vote
1answer
115 views

How to watch communication between 2 processes?

I have exe file in my pc(exe1) that send message to another exe (client-server maybe). I dont know which exe recived this message from exe1 and with which iso that message encoding. How can I see ...
3
votes
2answers
153 views

Hybrid binary analysis tool

I have an idea to merge static and dynamic analysis into a visualization through the IDA python scripting interface. The concept involves automatically setting breakpoints at each function or basic ...
2
votes
1answer
80 views

Detect interesting testcases

Suppose I have a ton of test cases and my target is closed-source. Well, I need to know which test cases discover new path in the execution of my target and which are duplicated. I know I have to use ...
7
votes
1answer
150 views

How to detect internal and shared libraries used in an executable file?

Problem: We want to be able to tell with some certainty that specific versions of internal libraries are being used by a program. For example, if a software uses old, deprecated libraries internally. ...
1
vote
0answers
126 views

Hook function in Linux SO file

I'm working on reverse engineering an Android application where the native code opens TLS connections using a built-in copy of mbedtls with certificate pinning. I'd like to decrypt that traffic and ...
1
vote
1answer
269 views

bypassing anti-VM inside protected samples

This is a good starting point. As you know: Sandboxes and virtual environments (hypervisors) are full of artifacts that betray their analysis environment. Malware can protect itself against these by ...
-1
votes
1answer
284 views

Dynamic Analysis on ELF using IDA

On Linux, while generally reversing ELF files and dynamic analyzing (like step into, step over, break-point, inspecting registers value, memory etc) I use gdb or radare2 which provides dynamic ...
1
vote
1answer
212 views

Is it possible to set breakpoints relatively to the memory block in x64dbg or a similar debugger?

Some of my breakpoints perfectly survive multiple restarts. But many interesting parts of the code I am debugging have different locations in memory after a restart. It seems the reason is, that the ...
1
vote
2answers
79 views

Test malware files in host machine?

To analyze malware files we are using virtual machine and virtual box but some of malware detect the environment and will not do its work properly. I want to know how to test malware files with out ...
0
votes
1answer
180 views

How can I circumvent rdtsc when used as an anti-debugger technique?

I using x86dbg and am working on unpacking a target. The unpacking stub appears to be using some anti-debugging techniques - most of which I can detour with a plugin. However, there are a lot of ...
3
votes
1answer
286 views

No apparent entry point for stripped, PIE binary using radare2

I am running on 64-bit Windows 7 and am using radare2 to attempt both static and dynamic analysis of a binary executable. The issue is that I cannot seem to find the entry point of where the program ...
0
votes
1answer
83 views

Configuring a C&C for a RAT [closed]

Where would I start when needing to configure a command and control server for a RAT? So that my dynamic analysis can be more complete. Note: I have been to the topics section of this stack exchange....
0
votes
2answers
765 views

How to unpack and decrypt malware? [duplicate]

Recently I have been working on reverse engineering of binary samples and executables of known malware. Most of them have been packed or encrypted. And to reach the actual data or part of the program ...
4
votes
0answers
106 views

Define function in x64dbg

I am reversing a fairly complex app. In x64dbg (with xAnalyzer), is it possible to have custom function definitions? A simple example would be to have a definition for WinMain(hInstance, ...
3
votes
3answers
727 views

Exe protection by TLS callback, trying to understand the behaviour

I have an app, obfuscated by FSG protector. When i tried to unpack it, the first thign that i had is, when i start the process with the debugger/or attach debugger later, i immediatly receive ACCESS ...
3
votes
2answers
324 views

Dealing with instructions that are accessed by multiple pieces of data

So to gain more experience with reversing, I am currently trying to write an external hack for a video game called Borderlands 2. I've been using cheat engine to scan for addresses of instructions ...
0
votes
1answer
676 views

How can I dynamically debug a malicious DLL? [duplicate]

English isn't my first language, So I will do my best ) I am trying to analyze some malware NotPetya and I can run the malware by running : rundll32.exe notpetya.dll #1 I am using Olly and trying ...
0
votes
0answers
523 views

Why some ppl don't use IDA Pro dbg to do dynamic analysis?

Could someone explain to me why there is so much people stating one should use IDA for static analysis and other dbg to dynamic analysis (ollydbg, x64dbg, etc)? I'm studying IDA for few months and I ...
1
vote
1answer
417 views

Could not find ld-linux-x86-64.so.2 in strace output

I did a ldd on /bin/cat and I see that dynamic loader library /lib64/ld-linux-x86-64.so.2 is a part of it. ldd /bin/cat linux-vdso.so.1 (0x00007ffe743f4000) libc.so.6 => /lib64/libc.so.6 (...
1
vote
1answer
1k views

IDA Pro debugging: follow child process

I'm reverse engineering a malware that creates a number of child processes and I'm trying to do dynamic analysis of the ELF binary with IDA Pro and IDA's Local Linux Debugger, but I can't get IDA to ...
0
votes
1answer
267 views

How to get better in re?

I'm a junior security researcher, and I'm interested in improving my ability in RE. I am a programmer at Assembly and C (and python and a few more high level lang). I learned and know how to use ...
0
votes
0answers
115 views

Vulnerability Analysis - Analysis of a crash

I fuzzed an application with a mutated file as input and got a crash at the following line : mov [ecx + ebp] , bl The mem. location dereferenced by ecx + ebp was invalid. So, then I used !...
1
vote
3answers
934 views

How to monitor/reverse engineer RS485-connected display device traffic?

Can anyone point me in the right direction for tutorials etc on reverse engineering RS484 connected battery management system? I have a large 12V lithium battery module which has an internal BMS and ...
0
votes
2answers
167 views

How to perform memory address translation on x86 instructions?

I have a mechanism that maps memory addresses to other memory addresses, e.g.: { 0x10000 -> 0xA0000 0x20000 -> 0x99000000 0x340000 -> 0x50000000 ; Stack in this example } Some example ...
5
votes
1answer
582 views

Analysis of SSL traffic from a Windows 10 application

I have to analyse SSL traffic of an executable under Windows 10. This sounds trivial really, why not just use Burp suite? Using Burp Using Burp I setup an invisible proxy listenning on port 443 and ...
0
votes
1answer
317 views

Dynamic Analysis Detection

Suppose you want to conceal an application's true purpose from analysts by reacting to dynamic analysis tools. How is it possible to detect running (in debugger mode) the application under a reverse ...
1
vote
1answer
346 views

Call Android method without running whole Android-App

I want to ask if somebody is aware of tools/projects which are similar to the Appcall feature of IDA Pro[1] for Android Apps? I'm looking for the possibility to run certain methods detected in the ...
1
vote
0answers
303 views

OllyDbg step over command not behaving exactly as the Immunity Debugger

I am taking Lena Reverse Engineering Tutorial and it uses OllyDbg debugger for its teaching. In the first chapter, he shows the file in OllyDbg debugger and steps over through it "step by step" until ...
0
votes
1answer
219 views

What is the relationship between the Windows API and the C run time library? [closed]

I have two reports of static and dynamic malware analysis. There are some APIs of MSVCRT's dll in my static report, which are missing in the dynamic report. (such as _p_commode, _setusermatherr, etc.) ...
5
votes
1answer
2k views

Unicorn and QEMU: Example use cases to understand the differences

The Unicorn website lists some differences between Unicorn and QEMU, especially those differences "where Unicorn shines". They furthermore write: A notable difference between Unicorn and QEMU is ...
0
votes
1answer
551 views

How to get the runtime memory region information when instrumenting using Pin?

I am using Pin for some execution monitoring tasks towards x64 ELF binary code. During the monitoring, for any memory write/read operation of the original code, I would like to record it as long as ...
3
votes
3answers
206 views

Dynamic instrumentation tools which support reverse execution

I am trying to analyze some execution crash information, and to better identify the root cause of memory access error, I would like to reverse execute the program from the crash point. For example, ...
2
votes
2answers
267 views

Dynamic analysis of malware samples

I have thousands of Linux malware samples in ELF format. And I am thinking to use dynamic analysis (say, PIN) to obtain an execution trace of each malware sample. However, I am afraid such activity ...
0
votes
0answers
74 views

Automatically tagging an executable

I am wondering if there is any tool that can do this job: Given an utility executable (for example, binaries from GNU Coreutils), this system can automatically tag it, say, assigning an "encoding", "...
2
votes
1answer
472 views

Analyzing a Login Process

I am reverse engineering a program that uses a custom auth protocol. This is a basic outline of the process: Client takes input for username and password, then sends username to the auth server. Auth ...
0
votes
2answers
864 views

Configure and execute Intel's PIN Tool

I am trying to develop a Pintool on Windows. But so far I have been unable to configure or execute PIN. I have Microsoft Visual Studio 10.0 installed on my system. I have also downloaded and unzipped ...
1
vote
1answer
107 views

Different basic block count when running application several times

I've been testing DynamoRio and minblox to do coverage analysis, and I've got a question, when I run a the bbcount sample on ping.exe (not passing parameters) several times, I get different count of ...
0
votes
1answer
76 views

What is the difference between Intrusive Attaching and Non-Intrusive Attaching when debugging?

In Core Debugger Concepts What is the difference between Intrusive Attaching and Non-Intrusive Attaching when debugging?
1
vote
1answer
463 views

Variable's position on stack

I wanna create a script/program that will modify value in memory of another process. With GDB I've discovered that variable I want modify is located on heap. Because this variable is create ...
1
vote
1answer
118 views

Capstone Disassembly Engine Issue: OP_Access throws TypeError

After installing the Capstone python module, I ran this example on a Win7x86 PC with a minor edit (added arch and mode). However, when attempting to use insn.regs_access(), it throws a NoneType ...
0
votes
1answer
637 views

Any tips for analyzing this mips function

These function are used to decrypt with AES and there is Decrypt by CRC and I assume that crc is used for data checksums, I have qemu-mipsel and my question for u is how could I discover from where ...
2
votes
2answers
989 views

Generating call graph for assembly instructions

I'm writing a tool and I need to generate the callgraph for assembly instructions. But I do not know how to exactly generate call graph from assembly instruction. Do you have any idea? To clarify, I ...
9
votes
1answer
218 views

Saving program execution state for fuzzing

Suppose I have a program that has two functions, functionA and functionB called sequentially. functionA requires a significant amount of processing in order to execute, and in the course of the ...
1
vote
2answers
516 views

identify packer compression or encryption algorithm

I do have an executable packed file. I want to detect compression or encryption algorithm dynamic and static ways separatly; of course without signature base way. How can I detect compression or ...
1
vote
1answer
76 views

How can I recover / locate non-virtual class methods at run-time?

I know how to find and hook virtual methods by crawling an object's RTTI. I cannot find enough information about non-virtual class methods. Is there anyway to identify non-virtual class methods at ...