Questions tagged [dynamic-analysis]

Analysis of a piece of code by letting it run (fully or step-by-step) on a real system or in a virtualized environment, as opposed to static analysis.

Filter by
Sorted by
Tagged with
0 votes
0 answers
34 views

How can I make a quick tracer for a PE file?

INTRODUCTION: I made my tracer on the event debug loop, but after I compared its speed characteristics with the same PinTool or similar tools, I realized that my tracer is several dozen times slower ...
Swoke's user avatar
  • 11
0 votes
1 answer
151 views

How learn which functions are called in .so library at Android?

I want to learn how listen certain .so files. I mean what is the way to know which fuctions are called which body of code executed in shared library at Android? I just wanted mofify stock camera on my ...
Savox Saastuxl's user avatar
1 vote
1 answer
95 views

How can i remove dead code and opaque predicates?

I have the following problem on my agenda: There is an obfuscated .exe (this is a virus that I am investigating) in addition to having an MBA, etc. bullshit, he has Opaque predicates and dead code, I ...
Swoke's user avatar
  • 11
2 votes
1 answer
88 views

other than x32dbg, is there a more friendly way to check functions, their args and their return values on runtime?

atm I'm using ida and x32dbg, when I find a function that interests me, I set a breakpoint on x32dbg, however, I'm not good enough at assembly to know everything from a function just from looking at ...
felipebubu's user avatar
3 votes
1 answer
350 views

How to reverse Engineer a Struct in IDA Pro?

How to identify and define a struct in IDA pro Decompiling during reverse engineering? Please explain the easiest way to figure out the struct in IDA Pro decompilation! To make life easier are there ...
Jose I. Hughes's user avatar
2 votes
1 answer
63 views

In Pintool, How to find the name of an routine's caller?

I want to trace the mutex variables in my rust program(e.g. which mutex called lock() and unlock() methods). And I think there're static methods.
roo jack's user avatar
0 votes
0 answers
62 views

Why is Windows 10 still blocking me from running malware?

I am analyzing some malware on Windows 10. I installed FLARE VM, disabled tamper protection and disabled the virus scanner in the registry. However when I attempt to run a malware, Windows is still ...
Jason Crosby's user avatar
2 votes
0 answers
33 views

How to re-create media file from android sender output stream

I would like to perform dynamic analysis on some android apps to check if these apps sending metadata with media files or not. Ideas like the picture below: Step 1: I prepared an image with metadata (...
ThanhLam112358's user avatar
3 votes
0 answers
66 views

Reverse engineering LCD memory map

I'm trying to get RAW data from a laser rangefinder device, but it has no PC connection ports. It has a small LCD screen onboard, where all data is displayed: distance, angle, battery level, etc. ...
artsin's user avatar
  • 131
5 votes
1 answer
359 views

Disassembling a DOS game with dynamic code/overlays in IDA Pro

I'm working on a disassembly of an old DOS game. (Real old: 16-bit, real mode.) The bulk of the game is in a large resource file of mixed binary and data; the executable basically just loads a chunk ...
Peter Malamud Smith's user avatar
3 votes
0 answers
174 views

Solved: Unable to hook Apple binary on iOS 14.x with Frida

I'm attempting to analyze a binary from iOS 14.8 (searchpartyd). I'm using Frida to try to hook it like I normally would with other binaries. However, I'm getting an error message that I'm unable to ...
AGreen BHM's user avatar
3 votes
0 answers
71 views

Is there a Capturebat alternative on windows 10 for file capture?

I've been looking for a capturebat alternative that will function on Windows 10 and 64 bit. I'm not interested in capturbat's network capabilities; rather, I'm interested in its capacity to capture ...
dakar111's user avatar
1 vote
1 answer
625 views

.NET: How to debug or decompile a DanamicMethod with dnSpy?

I have a managed .NET executable that supplies the msil bytecode of a function as raw bytes. It constructs a DynamicMethod object, sets the bytecode with DynamicMethod.DynamicILInfo.SetCode() and ...
bernd feinman's user avatar
0 votes
1 answer
118 views

Malware application in Android

Is there some website that give us the possibility to download malware APK in order to study it? I’m interested to study the abuse of android.permission.RECORD_AUDIO in Android 8.
Gregor's user avatar
  • 37
1 vote
1 answer
408 views

How to debug a malware that does DLL injection into explorer.exe?

What steps would you suggest for debugging a malware that injects a DLL into explorer.exe? using X32dbg have already attached explorer.exe to x32dbg
purple.jar's user avatar
3 votes
0 answers
52 views

Are there sampling profilers for stripped binaries?

I have a stripped binary in which I need to find the code for a particular function. I can run the binary on input which will make it spend a significant percentage of CPU time in that function. Maybe ...
Rafał Dowgird's user avatar
1 vote
0 answers
88 views

How to get the call stack of WinAPI functions?

Yesterday, I noticed an answer to a question about the purpose of a certain undocumented function, which is a call stack (including the DLL library) for this function, This got me interested in the ...
Int Ver's user avatar
  • 115
0 votes
1 answer
163 views

How to find the first function that sets the value currently stored in a given register?

I'm interested in a general approach to the following problem: The function F_Init allocates a byte buffer called Buffer with a size called BufSize. The Buffer is allocated with each frame/iteration ...
01101111's user avatar
0 votes
1 answer
98 views

How to detect incorrectly named DLL?

I am trying a simple lab on malware analysis and we were given both an .exe and .dll file. However, I am told that the DLL will need to be renamed to something for it to work. How do I go about ...
Iva l's user avatar
  • 1
1 vote
1 answer
66 views

how to bypass the instruction for antiDBI

This instruction stops the execution of the pin code jmp far 0x161061d, 0x33 ? how to get around this?
ALex's user avatar
  • 21
2 votes
0 answers
463 views

calculate memory address from IDA to use with Frida

I saw an interesting value in IDA at address 0xf8766; I want to view the value at that address. I debug an Android application with Frida, how can I put this address in Frida to watch this value? I ...
frida's user avatar
  • 41
0 votes
1 answer
92 views

Dynamic instrumentation tool for injecting assembly

I'm not sure about all tools. But afaik at least with Frida functions are patched and new code is added to other memory regions and then jumped to. The rest of the code layout stays the same. Is there ...
nimpi's user avatar
  • 1
2 votes
1 answer
1k views

How to call a func in an executable binary?

I have a binary with a func that I can disassemble. What are simple ways for me to call it with arbitrary args and observe its return val and behavior? Ideally, I'd like to do this: Within gdb (or ...
SRobertJames's user avatar
1 vote
1 answer
151 views

Adding ltrace information to gdb

I'd like to run gdb (or gdb-peda) with ltrace like info on each syscall. How can I do that? I know that, as per ltrace and gdb attach to same process , you can't actually attach ltrace and gdb to the ...
SRobertJames's user avatar
0 votes
1 answer
305 views

PEDA: Don't show context

gdb-peda shows a very useful context each time it stops (b, si, etc.), but sometimes I don't want it. Is there any way to quiet it so it won't show the context automatically (unless prompted context)?...
SRobertJames's user avatar
1 vote
0 answers
43 views

Capturing created and deleted files from a Java file

I am new to the malware analysis field but I do have an issue, a file I am working on creates 2 vbs files, reads from them and deletes them, this all happens in around 2 seconds. Also this is a Java ...
Tyler Edmonds's user avatar
0 votes
1 answer
4k views

In x64dbg, how to set software breakpoint on specific memory address?

This is something I know how to do in Olly Debugger, and can't figure out how to do in x64dbg. In Olly Debugger, it's possible to set a hardware or software breakpoint, either on access or on write, ...
tomysshadow's user avatar
1 vote
3 answers
1k views

CaptureBAT equivalent on Windows 10?

Hello RE community on stack ! I am a beginner, so please pardon any commonplace errors I am looking to run CaptureBAT on a Windows 10 VM, to capture network activity of different kinds of Malwares I ...
Muhammad Yasir's user avatar
0 votes
1 answer
163 views

Is it possible to make a dynamic memory allocated .data segment to static in a file?

Sorry if this is a dumb question I'm new to assembly. Basically I want to modify a function in a .exe file to return with a different data, but my issue is that the memory location of the data segment ...
Sejt's user avatar
  • 3
0 votes
0 answers
115 views

Pin DBI tool - Create executable

I'm starting to learn Intel's Pin framework and I can't figure out if it's possible to create an executable. I mean, rather than creating a module and forcing people to download Pin + the module, is ...
Reginas's user avatar
0 votes
0 answers
42 views

Jumping to a specific logation for DLL injection : OllyDbg

Hypothetically, If I'm hijacking a DLL but user space is in a sandbox; upon debugging, sandbox initiates at 0x345678 and I want to move to the space before it initiates: Can I call a jmp function ...
muhammad's user avatar
1 vote
0 answers
272 views

Dynamic Analysis with gdb on ELF binaries with no compilation/linking information

I am trying to do some dynamic analysis on a couple of ELF binaries with gdb. However, since those two are directly downloaded (ELF binary file only) with no additional information related to ...
eda's user avatar
  • 11
0 votes
0 answers
203 views

Forcing embedded libcurl to disable SSL verification

I am trying to decrypt HTTPs communications in a binary that I know has been statically linked with cURL. How can I force curl to not verify SSL certificates for fiddler to intercept? I am using the ...
Citrio's user avatar
  • 1
0 votes
2 answers
174 views

Is manually converting/decompiling x86 source code to C/C++/etc... considered reverse engineering?

I have the source code of an old program written in 32-bit x86 assembler that I am working on manually rewriting in C. The first time someone asked me about this project I told them I was 'reverse ...
Nux's user avatar
  • 133
1 vote
1 answer
494 views

frida - The specified child already has a parent. You must call removeView() on the child's parent first when hooking, how do you solve it?

I wanted to hook the method A1f in the below code but frida returns the following exceptions: Found instance: MyHomeFragment{9bbd8d5} (0965bca9-4838-4ca1-a835-d99639ae15f1)} java.lang....
hanan's user avatar
  • 309
3 votes
0 answers
796 views

How can I practically approach VM-obfuscated code with symbolic analysis/execution?

Dealing with VM-obfuscated code and started learning about symbolic analysis but having a hard time wrapping my head around how to practically apply it to a problem. If someone can give me some ...
patchrail's user avatar
  • 143
0 votes
1 answer
171 views

Debug process that use /dev/watchdog

I want to debug a process with gdb into Linux system, but the problem is that process pings /dev/watchdog so when I tried to debug it, it stop the process for longer than the watchdog interval so the ...
yfr24493AzzrggAcom's user avatar
3 votes
1 answer
1k views

Dynamic analysis (Frida) reveals instance of a class that doesn't exist in the source code (dex2jar)

I have been diving into an apk's source code, doing both static analysis with Jadx (same as dex2jar) and dynamic analysis with Frida. I am trying to replicate the method that signs HTTP requests "...
Kévin's user avatar
  • 33
1 vote
1 answer
403 views

Charles TLS Proxy for Android device with root access

I am trying to setup a TLS proxy with Charles proxy to man-in-the-middle an Android app. I would like to be able to view the contents of HTTPS traffic. This is not an app that I built, rather I am ...
hft's user avatar
  • 181
1 vote
2 answers
980 views

Is frida-server latest version compatible with old Android versions

I'm trying to figure out, if it's appropriate to use frida-server latest version (12.8.x at the moment of writing this question), on any Android version (even the old ones like KitKat). I'm asking ...
Sidahmed's user avatar
  • 111
3 votes
0 answers
83 views

How to retrieve generically memory reads of an input and determine all relevant offsets?

I would like to record all memory read operations that are performed by an application on a given input file, to help infer which specific parts of an input are relevant for the specific execution ...
MmM's user avatar
  • 31
1 vote
1 answer
182 views

Get function return value

Any idea for more ways to get return value? (No hooks, no hw/memory breakpoints, no call functions). thx :) I tried to find a dword maybe that hold the function return, but I didn't find it. I'm ...
yoni's user avatar
  • 59
1 vote
1 answer
129 views

Android dynamic UI state inspection/profiling tool

I am looking after for a command-line tool that can perform dynamic view hierarchy analysis similar to the UI tool in Android Studio https://developer.android.com/studio/debug/layout-inspector. Is ...
Zhen Zhang's user avatar
1 vote
1 answer
174 views

How to create an executable that keeps the same virtual address on different runs

I want to create an executable that keeps the same virtual address during different execution runs. This is definitely possible because I've seen these files in CTFs(Capture the flag) where the ...
rderik's user avatar
  • 113
0 votes
1 answer
143 views

Break when exe send tcp packet

When I debug exe file with Ida I want to put breakpoint before the exe file send tcp packet. When I listen with procmon I can see that this exe send and recive tcp packet. 1) I look on the exe file ...
joif doi's user avatar
0 votes
1 answer
205 views

x64dbgpy: application unresponsive when trying to automate inside breakpoint callback

When a breakpoint callback is triggered trying to automate the debugger inside the callback causes the application to become unresponsive. x64dbg continues functioning but the application itself doesn'...
user3238415's user avatar
3 votes
1 answer
998 views

Radare2 - How to debug Android native code (dynamic analysis)?

I'm using Termux(root) on LineageOS 16 (Android 9) with radare2 (v3.6.0 linux-arm32). When i attach to a process with 'r2 -d pid' the app freezes properly but doesn't continue with 'dc'. I'm not sure ...
Maniaxx's user avatar
  • 173
0 votes
1 answer
6k views

How do I find the address of a data location at runtime?

I'm using ghidra and cheat engine to reverse engineer a game's function. In ghidra's decompiler this function references two locations known as _DAT_XXX. I know the addresses of these locations in the ...
DohnJoe's user avatar
  • 65
1 vote
0 answers
275 views

Reconstructing struct/union-based IPC protocol wire format

I'm embarking on my first reverse-engineering adventure. I think I've picked a rather dense piece of steak to start out with. I have three C programs which communicate together using an unknown IPC ...
i336_'s user avatar
  • 121
2 votes
1 answer
3k views

Difficulty in debugging with dnSpy

I have a dotnet malware sample that I'm trying to debug with dnSpy. It has string obfuscation (contains function names such as BarriersBottomed, etc.) I cleaned the sample using de4dot and renamed ...
Nikhil's user avatar
  • 23