Questions tagged [dynamic-analysis]
Analysis of a piece of code by letting it run (fully or step-by-step) on a real system or in a virtualized environment, as opposed to static analysis.
147 questions
1
vote
1
answer
42
views
Dynamic analysis of Android applications' interaction
There are two or even more Android applications that somehow interact with each other:
Application A invokes application B or sends request to it directly or via third application C. I don't have the ...
- 113
2
votes
2
answers
110
views
Tracing all functions in executable conditionally, to find function of interest
I would like to alter the behavior of some executable (in my case, a videogame). One way of doing this is to hook function calls (e.g., a function like Player::ReceiveDamage) and adjust parameters/...
- 125
1
vote
0
answers
65
views
How to hook or call "non-native/non-exported functions"?
I wrote this simple application in C++ to learn about reverse engineering:
#include <iostream>
#include <windows.h>
void PrintMessage(const char *message) {
std::cout << message ...
- 11
0
votes
1
answer
406
views
How learn which functions are called in .so library at Android?
I want to learn how listen certain .so files. I mean what is the way to know which fuctions are called which body of code executed in shared library at Android? I just wanted mofify stock camera on my ...
1
vote
1
answer
189
views
How can i remove dead code and opaque predicates?
I have the following problem on my agenda: There is an obfuscated .exe (this is a virus that I am investigating) in addition to having an MBA, etc. bullshit, he has Opaque predicates and dead code, I ...
- 11
2
votes
1
answer
103
views
other than x32dbg, is there a more friendly way to check functions, their args and their return values on runtime?
atm I'm using ida and x32dbg, when I find a function that interests me, I set a breakpoint on x32dbg, however, I'm not good enough at assembly to know everything from a function just from looking at ...
- 23
3
votes
1
answer
678
views
How to reverse Engineer a Struct in IDA Pro?
How to identify and define a struct in IDA pro Decompiling during reverse engineering?
Please explain the easiest way to figure out the struct in IDA Pro decompilation!
To make life easier are there ...
2
votes
1
answer
79
views
In Pintool, How to find the name of an routine's caller?
I want to trace the mutex variables in my rust program(e.g. which mutex called lock() and unlock() methods). And I think there're static methods.
- 21
0
votes
0
answers
73
views
Why is Windows 10 still blocking me from running malware?
I am analyzing some malware on Windows 10. I installed FLARE VM, disabled tamper protection and disabled the virus scanner in the registry. However when I attempt to run a malware, Windows is still ...
- 131
2
votes
0
answers
35
views
How to re-create media file from android sender output stream
I would like to perform dynamic analysis on some android apps to check if these apps sending metadata with media files or not.
Ideas like the picture below:
Step 1: I prepared an image with metadata (...
- 121
3
votes
0
answers
73
views
Reverse engineering LCD memory map
I'm trying to get RAW data from a laser rangefinder device, but it has no PC connection ports. It has a small LCD screen onboard, where all data is displayed: distance, angle, battery level, etc. ...
- 131
5
votes
1
answer
551
views
Disassembling a DOS game with dynamic code/overlays in IDA Pro
I'm working on a disassembly of an old DOS game. (Real old: 16-bit, real mode.) The bulk of the game is in a large resource file of mixed binary and data; the executable basically just loads a chunk ...
3
votes
0
answers
205
views
Solved: Unable to hook Apple binary on iOS 14.x with Frida
I'm attempting to analyze a binary from iOS 14.8 (searchpartyd). I'm using Frida to try to hook it like I normally would with other binaries. However, I'm getting an error message that I'm unable to ...
- 31
3
votes
0
answers
102
views
Is there a Capturebat alternative on windows 10 for file capture?
I've been looking for a capturebat alternative that will function on Windows 10 and 64 bit.
I'm not interested in capturbat's network capabilities; rather, I'm interested in its capacity to capture ...
- 31
1
vote
1
answer
706
views
.NET: How to debug or decompile a DanamicMethod with dnSpy?
I have a managed .NET executable that supplies the msil bytecode of a function as raw bytes. It constructs a DynamicMethod object, sets the bytecode with DynamicMethod.DynamicILInfo.SetCode() and ...
- 463
0
votes
1
answer
139
views
Malware application in Android
Is there some website that give us the possibility to download malware APK in order to study it? I’m interested to study the abuse of android.permission.RECORD_AUDIO in Android 8.
- 37
1
vote
1
answer
478
views
How to debug a malware that does DLL injection into explorer.exe?
What steps would you suggest for debugging a malware that injects a DLL into explorer.exe?
using X32dbg
have already attached explorer.exe to x32dbg
- 11
3
votes
0
answers
60
views
Are there sampling profilers for stripped binaries?
I have a stripped binary in which I need to find the code for a particular function. I can run the binary on input which will make it spend a significant percentage of CPU time in that function. Maybe ...
- 131
1
vote
0
answers
131
views
How to get the call stack of WinAPI functions?
Yesterday, I noticed an answer to a question about the purpose of a certain undocumented function, which is a call stack (including the DLL library) for this function, This got me interested in the ...
- 137
0
votes
1
answer
184
views
How to find the first function that sets the value currently stored in a given register?
I'm interested in a general approach to the following problem:
The function F_Init allocates a byte buffer called Buffer with a size called BufSize. The Buffer is allocated with each frame/iteration ...
- 3
0
votes
1
answer
128
views
How to detect incorrectly named DLL?
I am trying a simple lab on malware analysis and we were given both an .exe and .dll file.
However, I am told that the DLL will need to be renamed to something for it to work.
How do I go about ...
- 1
1
vote
1
answer
70
views
how to bypass the instruction for antiDBI
This instruction stops the execution of the pin code jmp far 0x161061d, 0x33 ? how to get around this?
- 21
2
votes
0
answers
538
views
calculate memory address from IDA to use with Frida
I saw an interesting value in IDA at address 0xf8766; I want to view the value at that address.
I debug an Android application with Frida, how can I put this address in Frida to watch this value?
I ...
- 41
0
votes
1
answer
103
views
Dynamic instrumentation tool for injecting assembly
I'm not sure about all tools. But afaik at least with Frida functions are patched and new code is added to other memory regions and then jumped to. The rest of the code layout stays the same. Is there ...
- 1
3
votes
1
answer
2k
views
How to call a func in an executable binary?
I have a binary with a func that I can disassemble. What are simple ways for me to call it with arbitrary args and observe its return val and behavior?
Ideally, I'd like to do this:
Within gdb (or ...
- 277
1
vote
1
answer
191
views
Adding ltrace information to gdb
I'd like to run gdb (or gdb-peda) with ltrace like info on each syscall. How can I do that?
I know that, as per ltrace and gdb attach to same process , you can't actually attach ltrace and gdb to the ...
- 277
0
votes
1
answer
371
views
PEDA: Don't show context
gdb-peda shows a very useful context each time it stops (b, si, etc.), but sometimes I don't want it. Is there any way to quiet it so it won't show the context automatically (unless prompted context)?...
- 277
1
vote
0
answers
43
views
Capturing created and deleted files from a Java file
I am new to the malware analysis field but I do have an issue, a file I am working on creates 2 vbs files, reads from them and deletes them, this all happens in around 2 seconds. Also this is a Java ...
0
votes
1
answer
6k
views
In x64dbg, how to set software breakpoint on specific memory address?
This is something I know how to do in Olly Debugger, and can't figure out how to do in x64dbg.
In Olly Debugger, it's possible to set a hardware or software breakpoint, either on access or on write, ...
- 137
1
vote
3
answers
2k
views
CaptureBAT equivalent on Windows 10?
Hello RE community on stack !
I am a beginner, so please pardon any commonplace errors
I am looking to run CaptureBAT on a Windows 10 VM, to capture network activity of different kinds of Malwares
I ...
- 111
0
votes
1
answer
188
views
Is it possible to make a dynamic memory allocated .data segment to static in a file?
Sorry if this is a dumb question I'm new to assembly.
Basically I want to modify a function in a .exe file to return with a different data, but my issue is that the memory location of the data segment ...
- 3
0
votes
0
answers
122
views
Pin DBI tool - Create executable
I'm starting to learn Intel's Pin framework and I can't figure out if it's possible to create an executable.
I mean, rather than creating a module and forcing people to download Pin + the module, is ...
- 1
0
votes
0
answers
45
views
Jumping to a specific logation for DLL injection : OllyDbg
Hypothetically, If I'm hijacking a DLL but user space is in a sandbox; upon debugging, sandbox initiates at 0x345678 and I want to move to the space before it initiates:
Can I call a jmp function ...
- 1
1
vote
0
answers
323
views
Dynamic Analysis with gdb on ELF binaries with no compilation/linking information
I am trying to do some dynamic analysis on a couple of ELF binaries with gdb. However, since those two are directly downloaded (ELF binary file only) with no additional information related to ...
- 11
0
votes
0
answers
242
views
Forcing embedded libcurl to disable SSL verification
I am trying to decrypt HTTPs communications in a binary that I know has been statically linked with cURL. How can I force curl to not verify SSL certificates for fiddler to intercept? I am using the ...
- 1
0
votes
2
answers
180
views
Is manually converting/decompiling x86 source code to C/C++/etc... considered reverse engineering?
I have the source code of an old program written in 32-bit x86 assembler that I am working on manually rewriting in C.
The first time someone asked me about this project I told them I was 'reverse ...
- 133
1
vote
1
answer
537
views
frida - The specified child already has a parent. You must call removeView() on the child's parent first when hooking, how do you solve it?
I wanted to hook the method A1f in the below code but frida returns the following exceptions:
Found instance: MyHomeFragment{9bbd8d5} (0965bca9-4838-4ca1-a835-d99639ae15f1)}
java.lang....
- 309
3
votes
0
answers
1k
views
How can I practically approach VM-obfuscated code with symbolic analysis/execution?
Dealing with VM-obfuscated code and started learning about symbolic analysis but having a hard time wrapping my head around how to practically apply it to a problem. If someone can give me some ...
- 143
0
votes
1
answer
233
views
Debug process that use /dev/watchdog
I want to debug a process with gdb into Linux system, but the problem is that process pings /dev/watchdog so when I tried to debug it, it stop the process for longer than the watchdog interval so the ...
3
votes
1
answer
2k
views
Dynamic analysis (Frida) reveals instance of a class that doesn't exist in the source code (dex2jar)
I have been diving into an apk's source code, doing both static analysis with Jadx (same as dex2jar) and dynamic analysis with Frida.
I am trying to replicate the method that signs HTTP requests "...
- 33
1
vote
1
answer
467
views
Charles TLS Proxy for Android device with root access
I am trying to setup a TLS proxy with Charles proxy to man-in-the-middle an Android app. I would like to be able to view the contents of HTTPS traffic. This is not an app that I built, rather I am ...
- 191
1
vote
2
answers
1k
views
Is frida-server latest version compatible with old Android versions
I'm trying to figure out, if it's appropriate to use frida-server latest version (12.8.x at the moment of writing this question), on any Android version (even the old ones like KitKat).
I'm asking ...
- 111
3
votes
0
answers
85
views
How to retrieve generically memory reads of an input and determine all relevant offsets?
I would like to record all memory read operations that are performed by an application on a given input file, to help infer which specific parts of an input are relevant for the specific execution ...
- 31
1
vote
1
answer
186
views
Get function return value
Any idea for more ways to get return value?
(No hooks, no hw/memory breakpoints, no call functions).
thx :)
I tried to find a dword maybe that hold the function return, but I didn't find it.
I'm ...
- 69
1
vote
1
answer
159
views
Android dynamic UI state inspection/profiling tool
I am looking after for a command-line tool that can perform dynamic view hierarchy analysis similar to the UI tool in Android Studio https://developer.android.com/studio/debug/layout-inspector.
Is ...
- 121
1
vote
1
answer
205
views
How to create an executable that keeps the same virtual address on different runs
I want to create an executable that keeps the same virtual address during different execution runs.
This is definitely possible because I've seen these files in CTFs(Capture the flag) where the ...
- 113
1
vote
1
answer
207
views
Break when exe send tcp packet
When I debug .exe file with IDA, I want to put a breakpoint before the .exe sends a TCP packet.
When I listen with ProcMon I can see that this .exe sends and receives TCP packets.
I look at the .exe ...
- 41
0
votes
1
answer
230
views
x64dbgpy: application unresponsive when trying to automate inside breakpoint callback
When a breakpoint callback is triggered trying to automate the debugger inside the callback causes the application to become unresponsive. x64dbg continues functioning but the application itself doesn'...
- 203
3
votes
1
answer
1k
views
Radare2 - How to debug Android native code (dynamic analysis)?
I'm using Termux(root) on LineageOS 16 (Android 9) with radare2 (v3.6.0 linux-arm32). When i attach to a process with 'r2 -d pid' the app freezes properly but doesn't continue with 'dc'. I'm not sure ...
- 185
0
votes
1
answer
6k
views
How do I find the address of a data location at runtime?
I'm using ghidra and cheat engine to reverse engineer a game's function. In ghidra's decompiler this function references two locations known as _DAT_XXX. I know the addresses of these locations in the ...
- 65