We changed our privacy policy. Read more.

Questions tagged [dynamic-analysis]

Analysis of a piece of code by letting it run (fully or step-by-step) on a real system or in a virtualized environment, as opposed to static analysis.

Filter by
Sorted by
Tagged with
111
votes
1answer
85k views

How to handle stripped binaries with GDB? No source, no symbols and GDB only shows addresses?

I have GDB but the binary I want reverse engineer dynamically has no symbols, that is when I run the file utility it shows me stripped: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), ...
34
votes
5answers
10k views

How can I analyse an executable with no read permission?

I have a binary on a Linux (Kernel 2.6) which I can execute, but can't read (chmod 0711). Therefore no static analysis is possible. user1: $ ls -l bin -r-s--x--- user2 user1 bin user1: $ file bin ...
17
votes
3answers
3k views

Automated tools for file format reverse engineering?

Are there any tools available to help automate the process of reverse engineering file formats? In particular, I'm interested in tools that use dynamic analysis of an application to parse the format, ...
15
votes
1answer
2k views

Malware Hooking INT 1 and INT 3

I understand that on x86, INT 1 is used for single-stepping and INT 3 is used for setting breakpoints, and some other interrupt (usually 0x80 for Linux and 0x2E for Windows) used to be used for system ...
14
votes
3answers
9k views

Dynamic java instrumentation?

This is not strictly 'reverse engineering', it's mostly related to dynamic instrumentation. So, in the same fashion as strace which allows you to see syscalls made by a process, or ftrace to see ...
14
votes
2answers
4k views

Using QEmu monitor interface to extract execution traces from a binary?

My original point was to build something a bit more powerful and generic than a PTRACE system call for Linux platforms. The problem with PTRACE is that it only run on your own system and architecture. ...
11
votes
3answers
3k views

Hooking functions in Linux and/or OSX?

I want to hook functions in a library (lib.so or lib.dylib) from another process. I know that unlike windows libraries, libraries in Linux and Mac still have their symbols (function names and ...
10
votes
1answer
847 views

Static analysis data combined with dynamic analysis knowledge

What I'm doing now is placing an awful lot of comments about function variable values, global variable values as comments in my IDA database, which I find ugly after a while and obviously not a best ...
10
votes
2answers
2k views

Debugging EXE with TLS

How do I debug an executable that uses TLS callbacks? It's my understanding that these run before my debugger will attach.
10
votes
1answer
2k views

Kernel level Dynamic Binary Instrumentation

Is there anything like PIN or DynamoRIO to instrument at Kernel level? The platforms I'm more interested on are Windows and OSX.
9
votes
1answer
1k views

What are the differences between BitBlaze and BAP?

BitBlaze and BAP are two platforms to perform binary analysis. And, if I understand well, they are sharing lots of common features. What are their respective main features and in what do they differ ...
9
votes
1answer
405 views

Saving program execution state for fuzzing

Suppose I have a program that has two functions, functionA and functionB called sequentially. functionA requires a significant amount of processing in order to execute, and in the course of the ...
8
votes
3answers
1k views

How can I use DynamoRIO or something similar in Linux kernel space?

I've found some universities that are porting DynamoRIO (or something very similar) to Linux kernel space, but the code doesn't seem to be available. Is there a resource I am unaware of? Here's an ...
8
votes
1answer
3k views

What is MSR Tracing?

I was reading a old blog post on OpenRCE that mentions MSR tracing in the context of binary only profiling and coverage. The only Google hits for this term are a few emails on the Xen mailing list ...
8
votes
3answers
2k views

Re-engineering to create UML Diagrams from Source and Binary

Are there tools that would create: UML Structural Diagrams from Source Code. UML Behavioral Diagrams from Binary executing on a arm / x86 system. Sources would be in C &/ C++ &/ Python. ...
7
votes
2answers
7k views

How do I view external function calls in dynamically linked ELF binary in linux?

I used the file command in Linux to get information about a binary file. I am also looking for the addresses that these calls are located at. I think I can get this information from GDB or objdump but ...
7
votes
1answer
6k views

Emulating Routers and other Embedded Devices with QEMU

I'm thinking about reverse engineering a few router models and trying to get them running with QEMU. In particular I'm trying to get the web server running. The current issue I'm thinking might be a ...
7
votes
1answer
257 views

How to detect internal and shared libraries used in an executable file?

Problem: We want to be able to tell with some certainty that specific versions of internal libraries are being used by a program. For example, if a software uses old, deprecated libraries internally. ...
6
votes
4answers
645 views

Where can someone interested in the topic learn more about Dynamic binary instrumentation?

Generally, it's a complex topic. There seems to be very little in the way of example or linear progression in to non-trivial examples. It's possible my google-fu is weak, but I can't seem to ...
6
votes
1answer
4k views

Unicorn and QEMU: Example use cases to understand the differences

The Unicorn website lists some differences between Unicorn and QEMU, especially those differences "where Unicorn shines". They furthermore write: A notable difference between Unicorn and ...
6
votes
1answer
351 views

Use of SSA (Single Static Assignment) while dynamic analysis

I have read that dynamic instrumentation can be done using tools like PIN or Valgrind. However Valgrind provides intermediate representation and converts the binary into SSA which makes it more ...
6
votes
3answers
847 views

Is there any Dynamic Binary Instrumentation frameworks for Windows exposing an Intermediate Representation?

There are some excellent DBI frameworks for Windows (Intel PIN, DynamoRIO...) but unfortunately none of them expose an IR afaik. I am looking for something like Valgrind's VEX that works on Windows. ...
4
votes
2answers
2k views

Dealing with instructions that are accessed by multiple pieces of data

So to gain more experience with reversing, I am currently trying to write an external hack for a video game called Borderlands 2. I've been using cheat engine to scan for addresses of instructions ...
4
votes
1answer
862 views

Finding execution flow/calls to functions?

I have a binary and I'm interested in an high level overview of how it operates. I was trying to generate a list of functions called during a particular execution, with their hierarchy, for example ...
4
votes
1answer
1k views

vtrace / vivisect resources

Where can I find some resources to start learning about vivisect? Blog posts, presentations, PDFs, code examples, anything would be appreciated. I am aware I can read the code but before doing that ...
4
votes
1answer
1k views

Dynamic instrumentation tools

I've discovered recently PIN which allows to dynamically instrument the binary code while still making the program believe it is running unmodified. Even more recently, I've heared about Dyninst and ...
4
votes
0answers
617 views

How do I perform concolic execution with Angr and collect constraints on input?

I have a program that takes a string (with some structure) as input. My aim is to collect information on what values each character in input is compared to as it gets parsed using concolic execution. ...
3
votes
4answers
2k views

Dynamic Analysis for Shared Libraries?

Are there techniques for dynamic analysis of shared libraries? I know for example that DLLs have an entry point, but how about calling other exported functions? Do I need to write a custom executable ...
3
votes
1answer
5k views

Are there any Windows alternatives to INetSim?

I found a tool for Linux called INetSim which emulates services such as HTTP HTTPS IRC and many other. It is often used to trick malware. The problem is that INetSim works only on Linux. So I want ...
3
votes
2answers
2k views

Automated Assembly/Disassemble library

I'm writing a handy reverse tool in C++ with manual assembling/disassembling shell, to automate my work! I need an assembler library. Is there any library, embedding in C++?
3
votes
2answers
6k views

DLL - Dynamic Analysis on IDA

I'm "middle-new" in re and I have to debug a dll's function. How can I tell to IDA : start function XXX with parameters A, B and C ? Is there a solution or a plugin doing that ? I've tried doing that ...
3
votes
2answers
298 views

Hybrid binary analysis tool

I have an idea to merge static and dynamic analysis into a visualization through the IDA python scripting interface. The concept involves automatically setting breakpoints at each function or basic ...
3
votes
3answers
5k views

Exe protection by TLS callback, trying to understand the behaviour

I have an app, obfuscated by FSG protector. When i tried to unpack it, the first thign that i had is, when i start the process with the debugger/or attach debugger later, i immediatly receive ACCESS ...
3
votes
1answer
492 views

How should I approach debugging a PE which create a large database?

I am reversing several modules which are dynamically and statically linked into an executable. I have started learning active analysis by attaching one of my database files to the win32 exe using the ...
3
votes
2answers
751 views

IDA - save work on kernel mode debugging

I'm working with IDA pro on a kernel mode function (VMware + windbg) and I'm a annoying because I can't save the workstation state. IDA crash after 3 hours when I "quit and save memory status". Is ...
3
votes
1answer
2k views

Windbg: going from vftable to c++ class

As part of an assignment, I am delving into the world of Internet Explorer, and am trying to figure out exactly what class(es) are being allocated on the heap. In the mshtml!CEventObj::...
3
votes
1answer
611 views

Radare2 - How to debug Android native code (dynamic analysis)?

I'm using Termux(root) on LineageOS 16 (Android 9) with radare2 (v3.6.0 linux-arm32). When i attach to a process with 'r2 -d pid' the app freezes properly but doesn't continue with 'dc'. I'm not sure ...
3
votes
1answer
1k views

Analysis of SSL traffic from a Windows 10 application

I have to analyse SSL traffic of an executable under Windows 10. This sounds trivial really, why not just use Burp suite? Using Burp Using Burp I setup an invisible proxy listenning on port 443 and ...
3
votes
2answers
445 views

How to find location of environment variables in 64 bit binaries at runtime?

In the main function, program authors can choose to receive the char * array as a parameter to main that points to the environment variables int main(int argc, char **argv, char **envp) { ... } The ...
3
votes
0answers
245 views

How can I practically approach VM-obfuscated code with symbolic analysis/execution?

Dealing with VM-obfuscated code and started learning about symbolic analysis but having a hard time wrapping my head around how to practically apply it to a problem. If someone can give me some ...
3
votes
0answers
77 views

How to retrieve generically memory reads of an input and determine all relevant offsets?

I would like to record all memory read operations that are performed by an application on a given input file, to help infer which specific parts of an input are relevant for the specific execution ...
3
votes
0answers
201 views

Define function in x64dbg

I am reversing a fairly complex app. In x64dbg (with xAnalyzer), is it possible to have custom function definitions? A simple example would be to have a definition for WinMain(hInstance, ...
3
votes
0answers
379 views

How to quickly/easily make an analysis (reverse engineering) of the code of unknown CMS or framework on PHP? [closed]

I would like to know what tools and techniques do you use for rapid analyze of unknown code CMS or framework. If more specifically that for the following tasks: 1. To locate the file (s) html ...
2
votes
2answers
1k views

Pintool For OSX

I see that PinTool works for Windows and Linux. Does it also happen to work for OSX? Or is there a similar tool that I can use to easily record code coverage for a closed-source app?
2
votes
2answers
336 views

Dynamic analysis of malware samples

I have thousands of Linux malware samples in ELF format. And I am thinking to use dynamic analysis (say, PIN) to obtain an execution trace of each malware sample. However, I am afraid such activity ...
2
votes
2answers
1k views

Generating call graph for assembly instructions

I'm writing a tool and I need to generate the callgraph for assembly instructions. But I do not know how to exactly generate call graph from assembly instruction. Do you have any idea? To clarify, I ...
2
votes
2answers
660 views

How can I view in-memory strings of a process on Linux (Ubuntu)?

On Windows, I can use tools like Process Explorer and Process Hacker to view in-memory strings generated at runtime of a given process. How can I accomplish this same task on Ubuntu?
2
votes
4answers
857 views

Reverse engineering close sourced JSP applets

I have a web application written in JSP running on a tomcat 6 server that I want to RE. I've decompiled the .jars associated with the web application. The source code is heavily obfuscated, making it ...
2
votes
1answer
636 views

Call Android method without running whole Android-App

I want to ask if somebody is aware of tools/projects which are similar to the Appcall feature of IDA Pro[1] for Android Apps? I'm looking for the possibility to run certain methods detected in the ...
2
votes
3answers
252 views

Dynamic instrumentation tools which support reverse execution

I am trying to analyze some execution crash information, and to better identify the root cause of memory access error, I would like to reverse execute the program from the crash point. For example, ...