Questions tagged [dynamic-analysis]

Analysis of a piece of code by letting it run (fully or step-by-step) on a real system or in a virtualized environment, as opposed to static analysis.

Filter by
Sorted by
Tagged with
0
votes
0answers
22 views

Debug process that use /dev/watchdog

I want to debug a process with gdb, but the problem is that process pings /dev/watchdog so when I tried to debug it, it stop the process for longer than the watchdog interval so the system is ...
0
votes
1answer
138 views

How can I know what the executable is missing to run?

I have extracted a presence of MZ file from memory which happen to be available in virustotal ( might be a malicious executable). However, I could not run the program. It seems to have some missing ...
1
vote
1answer
50 views

Dynamic analysis (Frida) reveals instance of a class that doesn't exist in the source code (dex2jar)

I have been diving into an apk's source code, doing both static analysis with Jadx (same as dex2jar) and dynamic analysis with Frida. I am trying to replicate the method that signs HTTP requests "...
1
vote
1answer
30 views

Android dynamic UI state inspection/profiling tool

I am looking after for a command-line tool that can perform dynamic view hierarchy analysis similar to the UI tool in Android Studio https://developer.android.com/studio/debug/layout-inspector. Is ...
0
votes
1answer
682 views

How to find functions in IDA Pro/x64dbg

i created a program for testing, very simple in c++. is ask for password if it is match is print correct, if no it is print "bad". i try to find with ida where is the function of what i made. but i ...
0
votes
1answer
25 views

Is frida-server latest version compatible with old Android versions

I'm trying to figure out, if it's appropriate to use frida-server latest version (12.8.x at the moment of writing this question), on any Android version (even the old ones like KitKat). I'm asking ...
0
votes
0answers
23 views

Print Stacktrace when process read String

There is a process that prints HELLO , in Ida that simple to find it in Strings and watch with X-ref all the functions that read that strings. There is an option to put a hardware breakpoint on this ...
1
vote
1answer
35 views

Charles TLS Proxy for Android device with root access

I am trying to setup a TLS proxy with Charles proxy to man-in-the-middle an Android app. I would like to be able to view the contents of HTTPS traffic. This is not an app that I built, rather I am ...
1
vote
3answers
1k views

Configure and execute Intel's PIN Tool

I am trying to develop a Pintool on Windows. But so far I have been unable to configure or execute PIN. I have Microsoft Visual Studio 10.0 installed on my system. I have also downloaded and unzipped ...
0
votes
1answer
59 views

Get function return value

any idea for more ways to get return value? (no hooks, no hw/memory breakpoints, no call functions) thx :) tried to find dword maybe that hold the function return, didn't found. I'm trying to create ...
3
votes
0answers
69 views

How to retrieve generically memory reads of an input and determine all relevant offsets?

I would like to record all memory read operations that are performed by an application on a given input file, to help infer which specific parts of an input are relevant for the specific execution ...
2
votes
1answer
247 views

Radare2 - How to debug Android native code (dynamic analysis)?

I'm using Termux(root) on LineageOS 16 (Android 9) with radare2 (v3.6.0 linux-arm32). When i attach to a process with 'r2 -d pid' the app freezes properly but doesn't continue with 'dc'. I'm not sure ...
4
votes
0answers
415 views

How do I perform concolic execution with Angr and collect constraints on input?

I have a program that takes a string (with some structure) as input. My aim is to collect information on what values each character in input is compared to as it gets parsed using concolic execution. ...
0
votes
0answers
29 views

Reading float value within delphi binary

I have a Delphi program that I am trying to read data from. the data is stored in a TEIDataWindow, this particular snippet of code comes from the update method. the data is presented in the form of an ...
1
vote
1answer
58 views

How to create an executable that keeps the same virtual address on different runs

I want to create an executable that keeps the same virtual address during different execution runs. This is definitely possible because I've seen these files in CTFs(Capture the flag) where the ...
1
vote
0answers
100 views

Reconstructing struct/union-based IPC protocol wire format

I'm embarking on my first reverse-engineering adventure. I think I've picked a rather dense piece of steak to start out with. I have three C programs which communicate together using an unknown IPC ...
-1
votes
1answer
65 views

Break when exe send tcp packet

When I debug exe file with Ida I want to put breakpoint before the exe file send tcp packet. When I listen with procmon I can see that this exe send and recive tcp packet. 1) I look on the exe file ...
0
votes
2answers
623 views

How to get better in re?

I'm a junior security researcher, and I'm interested in improving my ability in RE. I am a programmer at Assembly and C (and python and a few more high level lang). I learned and know how to use ...
0
votes
1answer
81 views

x64dbgpy: application unresponsive when trying to automate inside breakpoint callback

When a breakpoint callback is triggered trying to automate the debugger inside the callback causes the application to become unresponsive. x64dbg continues functioning but the application itself doesn'...
0
votes
0answers
45 views

How instrument read/write access to local variable in a function

I have a large executable and facing a SIGSEGV in a function. I have tried a lot of things, but none has worked. I am planning to set up a PIN, but reading from the documentation I cannot figure out ...
-1
votes
1answer
549 views

How do I find the address of a data location at runtime?

I'm using ghidra and cheat engine to reverse engineer a game's function. In ghidra's decompiler this function references two locations known as _DAT_XXX. I know the addresses of these locations in the ...
0
votes
0answers
436 views

Differences between IDA Pro and Radare2

I am familiar with Hopper Disassembler and OllyDbg as favorite and simple tools, but I would like to try switching to IDA to work on Windows. However, I know about radare2 and that it is open source,...
2
votes
1answer
690 views

Difficulty in debugging with dnSpy

I have a dotnet malware sample that I'm trying to debug with dnSpy. It has string obfuscation (contains function names such as BarriersBottomed, etc.) I cleaned the sample using de4dot and renamed ...
0
votes
3answers
326 views

Most efficient way to begin analyzing malware binary

I'm taking a reverse engineering course and the class has just been given a big project where we have to analyze a packed malware binary. I am using a Windows 10 VM. I am a little confused on where to ...
1
vote
1answer
902 views

How to get the runtime memory region information when instrumenting using Pin?

I am using Pin for some execution monitoring tasks towards x64 ELF binary code. During the monitoring, for any memory write/read operation of the original code, I would like to record it as long as ...
1
vote
0answers
32 views

Instrumentation fail when app use far jump 0x33 crash

Do you known any dbi tool that support instrumentation of application that use far jump 0x33? P.S. pin, dymanoRIO don't support far jump 0x33.
7
votes
1answer
204 views

How to detect internal and shared libraries used in an executable file?

Problem: We want to be able to tell with some certainty that specific versions of internal libraries are being used by a program. For example, if a software uses old, deprecated libraries internally. ...
2
votes
1answer
93 views

Detect interesting testcases

Suppose I have a ton of test cases and my target is closed-source. Well, I need to know which test cases discover new path in the execution of my target and which are duplicated. I know I have to use ...
5
votes
1answer
4k views

Emulating Routers and other Embedded Devices with QEMU

I'm thinking about reverse engineering a few router models and trying to get them running with QEMU. In particular I'm trying to get the web server running. The current issue I'm thinking might be a ...
1
vote
1answer
306 views

What is ObjectStublessClientXX in ole32dll?

When I do dynamic reversing I saw usage with ObjectStublessClientXX in ole32.dll . What is that function? What does it do? Is there any way that it supposed to transfer message between 2 processes? ...
3
votes
0answers
168 views

Define function in x64dbg

I am reversing a fairly complex app. In x64dbg (with xAnalyzer), is it possible to have custom function definitions? A simple example would be to have a definition for WinMain(hInstance, ...
3
votes
2answers
259 views

Hybrid binary analysis tool

I have an idea to merge static and dynamic analysis into a visualization through the IDA python scripting interface. The concept involves automatically setting breakpoints at each function or basic ...
9
votes
1answer
321 views

Saving program execution state for fuzzing

Suppose I have a program that has two functions, functionA and functionB called sequentially. functionA requires a significant amount of processing in order to execute, and in the course of the ...
1
vote
1answer
522 views

bypassing anti-VM inside protected samples

This is a good starting point. As you know: Sandboxes and virtual environments (hypervisors) are full of artifacts that betray their analysis environment. Malware can protect itself against these by ...
2
votes
2answers
272 views

How can I view in-memory strings of a process on Linux (Ubuntu)?

On Windows, I can use tools like Process Explorer and Process Hacker to view in-memory strings generated at runtime of a given process. How can I accomplish this same task on Ubuntu?
-1
votes
1answer
748 views

Dynamic Analysis on ELF using IDA

On Linux, while generally reversing ELF files and dynamic analyzing (like step into, step over, break-point, inspecting registers value, memory etc) I use gdb or radare2 which provides dynamic ...
1
vote
1answer
186 views

How to watch communication between 2 processes?

I have exe file in my pc(exe1) that send message to another exe (client-server maybe). I dont know which exe recived this message from exe1 and with which iso that message encoding. How can I see ...
1
vote
3answers
2k views

How to monitor/reverse engineer RS485-connected display device traffic?

Can anyone point me in the right direction for tutorials etc on reverse engineering RS484 connected battery management system? I have a large 12V lithium battery module which has an internal BMS and ...
1
vote
1answer
934 views

Is it possible to set breakpoints relatively to the memory block in x64dbg or a similar debugger?

Some of my breakpoints perfectly survive multiple restarts. But many interesting parts of the code I am debugging have different locations in memory after a restart. It seems the reason is, that the ...
1
vote
0answers
353 views

Hook function in Linux SO file

I'm working on reverse engineering an Android application where the native code opens TLS connections using a built-in copy of mbedtls with certificate pinning. I'd like to decrypt that traffic and ...
1
vote
2answers
104 views

Test malware files in host machine?

To analyze malware files we are using virtual machine and virtual box but some of malware detect the environment and will not do its work properly. I want to know how to test malware files with out ...
0
votes
1answer
448 views

How can I circumvent rdtsc when used as an anti-debugger technique?

I using x86dbg and am working on unpacking a target. The unpacking stub appears to be using some anti-debugging techniques - most of which I can detour with a plugin. However, there are a lot of ...
6
votes
3answers
807 views

Is there any Dynamic Binary Instrumentation frameworks for Windows exposing an Intermediate Representation?

There are some excellent DBI frameworks for Windows (Intel PIN, DynamoRIO...) but unfortunately none of them expose an IR afaik. I am looking for something like Valgrind's VEX that works on Windows. ...
2
votes
1answer
799 views

No apparent entry point for stripped, PIE binary using radare2

I am running on 64-bit Windows 7 and am using radare2 to attempt both static and dynamic analysis of a binary executable. The issue is that I cannot seem to find the entry point of where the program ...
0
votes
1answer
115 views

Configuring a C&C for a RAT [closed]

Where would I start when needing to configure a command and control server for a RAT? So that my dynamic analysis can be more complete. Note: I have been to the topics section of this stack exchange....
0
votes
2answers
3k views

How to unpack and decrypt malware? [duplicate]

Recently I have been working on reverse engineering of binary samples and executables of known malware. Most of them have been packed or encrypted. And to reach the actual data or part of the program ...
3
votes
3answers
3k views

Exe protection by TLS callback, trying to understand the behaviour

I have an app, obfuscated by FSG protector. When i tried to unpack it, the first thign that i had is, when i start the process with the debugger/or attach debugger later, i immediatly receive ACCESS ...
4
votes
2answers
1k views

Dealing with instructions that are accessed by multiple pieces of data

So to gain more experience with reversing, I am currently trying to write an external hack for a video game called Borderlands 2. I've been using cheat engine to scan for addresses of instructions ...
0
votes
1answer
2k views

How can I dynamically debug a malicious DLL? [duplicate]

English isn't my first language, So I will do my best ) I am trying to analyze some malware NotPetya and I can run the malware by running : rundll32.exe notpetya.dll #1 I am using Olly and trying ...
6
votes
1answer
3k views

Unicorn and QEMU: Example use cases to understand the differences

The Unicorn website lists some differences between Unicorn and QEMU, especially those differences "where Unicorn shines". They furthermore write: A notable difference between Unicorn and QEMU is ...