Questions tagged [dynamic-analysis]

Analysis of a piece of code by letting it run (fully or step-by-step) on a real system or in a virtualized environment, as opposed to static analysis.

Filter by
Sorted by
Tagged with
0
votes
0answers
14 views

How to keep track of Dynamic Variables

The thing I'm trying to reverse has a lot of variables on allocated memory so I can't comment and keep track of the addresses as every time I re-run the software they will be different.. I'm working ...
0
votes
0answers
20 views

How to extract an AutoIT script when tools fail to extract it?

Lets say you have a Autoit malware (windows executable, autoit v3), and you want to extract the script from it. But tools such as exe2aut fail to extract it. What would you do? is there any place in ...
1
vote
0answers
33 views

Capturing created and deleted files from a Java file

I am new to the malware analysis field but I do have an issue, a file I am working on creates 2 vbs files, reads from them and deletes them, this all happens in around 2 seconds. Also this is a Java ...
0
votes
0answers
41 views

What is the difference between a file on disk and a file on memory?

Currently, I am learning about the differences between static and dynamic analysis. I have come across this incredible question that has been bugging me: What happens to the file (in memory) when you ...
0
votes
0answers
29 views

Can I find out what methods are being swizzled in runtime?

I have an obfuscated dylib injecting into a process in macOS to swizzle objc methods. Obviously I can decompile it to check what it is hooking, but its heavily obfuscated. Hence, can I find out what ...
0
votes
1answer
508 views

In x64dbg, how to set software breakpoint on specific memory address?

This is something I know how to do in Olly Debugger, and can't figure out how to do in x64dbg. In Olly Debugger, it's possible to set a hardware or software breakpoint, either on access or on write, ...
0
votes
2answers
385 views

CaptureBAT equivalent on Windows 10?

Hello RE community on stack ! I am a beginner, so please pardon any commonplace errors I am looking to run CaptureBAT on a Windows 10 VM, to capture network activity of different kinds of Malwares I ...
0
votes
1answer
63 views

Is it possible to make a dynamic memory allocated .data segment to static in a file?

Sorry if this is a dumb question I'm new to assembly. Basically I want to modify a function in a .exe file to return with a different data, but my issue is that the memory location of the data segment ...
0
votes
0answers
52 views

Pin DBI tool - Create executable

I'm starting to learn Intel's Pin framework and I can't figure out if it's possible to create an executable. I mean, rather than creating a module and forcing people to download Pin + the module, is ...
0
votes
0answers
24 views

Jumping to a specific logation for DLL injection : OllyDbg

Hypothetically, If I'm hijacking a DLL but user space is in a sandbox; upon debugging, sandbox initiates at 0x345678 and I want to move to the space before it initiates: Can I call a jmp function ...
1
vote
0answers
90 views

Dynamic Analysis with gdb on ELF binaries with no compilation/linking information

I am trying to do some dynamic analysis on a couple of ELF binaries with gdb. However, since those two are directly downloaded (ELF binary file only) with no additional information related to ...
0
votes
0answers
61 views

Forcing embedded libcurl to disable SSL verification

I am trying to decrypt HTTPs communications in a binary that I know has been statically linked with cURL. How can I force curl to not verify SSL certificates for fiddler to intercept? I am using the ...
0
votes
2answers
139 views

Is manually converting/decompiling x86 source code to C/C++/etc... considered reverse engineering?

I have the source code of an old program written in 32-bit x86 assembler that I am working on manually rewriting in C. The first time someone asked me about this project I told them I was 'reverse ...
0
votes
1answer
206 views

frida - The specified child already has a parent. You must call removeView() on the child's parent first when hooking, how do you solve it?

I wanted to hook the method A1f in the below code but frida returns the following exceptions: Found instance: MyHomeFragment{9bbd8d5} (0965bca9-4838-4ca1-a835-d99639ae15f1)} java.lang....
3
votes
0answers
253 views

How can I practically approach VM-obfuscated code with symbolic analysis/execution?

Dealing with VM-obfuscated code and started learning about symbolic analysis but having a hard time wrapping my head around how to practically apply it to a problem. If someone can give me some ...
0
votes
1answer
69 views

Debug process that use /dev/watchdog

I want to debug a process with gdb into Linux system, but the problem is that process pings /dev/watchdog so when I tried to debug it, it stop the process for longer than the watchdog interval so the ...
1
vote
1answer
337 views

Dynamic analysis (Frida) reveals instance of a class that doesn't exist in the source code (dex2jar)

I have been diving into an apk's source code, doing both static analysis with Jadx (same as dex2jar) and dynamic analysis with Frida. I am trying to replicate the method that signs HTTP requests "...
1
vote
1answer
207 views

Charles TLS Proxy for Android device with root access

I am trying to setup a TLS proxy with Charles proxy to man-in-the-middle an Android app. I would like to be able to view the contents of HTTPS traffic. This is not an app that I built, rather I am ...
1
vote
2answers
350 views

Is frida-server latest version compatible with old Android versions

I'm trying to figure out, if it's appropriate to use frida-server latest version (12.8.x at the moment of writing this question), on any Android version (even the old ones like KitKat). I'm asking ...
3
votes
0answers
77 views

How to retrieve generically memory reads of an input and determine all relevant offsets?

I would like to record all memory read operations that are performed by an application on a given input file, to help infer which specific parts of an input are relevant for the specific execution ...
0
votes
1answer
137 views

Get function return value

Any idea for more ways to get return value? (No hooks, no hw/memory breakpoints, no call functions). thx :) I tried to find a dword maybe that hold the function return, but I didn't find it. I'm ...
1
vote
1answer
64 views

Android dynamic UI state inspection/profiling tool

I am looking after for a command-line tool that can perform dynamic view hierarchy analysis similar to the UI tool in Android Studio https://developer.android.com/studio/debug/layout-inspector. Is ...
1
vote
1answer
70 views

How to create an executable that keeps the same virtual address on different runs

I want to create an executable that keeps the same virtual address during different execution runs. This is definitely possible because I've seen these files in CTFs(Capture the flag) where the ...
-1
votes
1answer
88 views

Break when exe send tcp packet

When I debug exe file with Ida I want to put breakpoint before the exe file send tcp packet. When I listen with procmon I can see that this exe send and recive tcp packet. 1) I look on the exe file ...
0
votes
1answer
135 views

x64dbgpy: application unresponsive when trying to automate inside breakpoint callback

When a breakpoint callback is triggered trying to automate the debugger inside the callback causes the application to become unresponsive. x64dbg continues functioning but the application itself doesn'...
3
votes
1answer
625 views

Radare2 - How to debug Android native code (dynamic analysis)?

I'm using Termux(root) on LineageOS 16 (Android 9) with radare2 (v3.6.0 linux-arm32). When i attach to a process with 'r2 -d pid' the app freezes properly but doesn't continue with 'dc'. I'm not sure ...
0
votes
1answer
3k views

How do I find the address of a data location at runtime?

I'm using ghidra and cheat engine to reverse engineer a game's function. In ghidra's decompiler this function references two locations known as _DAT_XXX. I know the addresses of these locations in the ...
1
vote
0answers
162 views

Reconstructing struct/union-based IPC protocol wire format

I'm embarking on my first reverse-engineering adventure. I think I've picked a rather dense piece of steak to start out with. I have three C programs which communicate together using an unknown IPC ...
2
votes
1answer
2k views

Difficulty in debugging with dnSpy

I have a dotnet malware sample that I'm trying to debug with dnSpy. It has string obfuscation (contains function names such as BarriersBottomed, etc.) I cleaned the sample using de4dot and renamed ...
1
vote
1answer
171 views

How can I know what the executable is missing to run?

I have extracted a presence of MZ file from memory which happen to be available in VirusTotal ( might be a malicious executable). However, I could not run the program. It seems to have some missing ...
-1
votes
1answer
2k views

How to find functions in IDA Pro/x64dbg

i created a program for testing, very simple in c++. is ask for password if it is match is print correct, if no it is print "bad". i try to find with ida where is the function of what i made. but i ...
0
votes
3answers
456 views

Most efficient way to begin analyzing malware binary

I'm taking a reverse engineering course and the class has just been given a big project where we have to analyze a packed malware binary. I am using a Windows 10 VM. I am a little confused on where to ...
1
vote
0answers
36 views

Instrumentation fail when app use far jump 0x33 crash

Do you known any dbi tool that support instrumentation of application that use far jump 0x33? P.S. pin, dymanoRIO don't support far jump 0x33.
8
votes
1answer
6k views

Emulating Routers and other Embedded Devices with QEMU

I'm thinking about reverse engineering a few router models and trying to get them running with QEMU. In particular I'm trying to get the web server running. The current issue I'm thinking might be a ...
4
votes
0answers
622 views

How do I perform concolic execution with Angr and collect constraints on input?

I have a program that takes a string (with some structure) as input. My aim is to collect information on what values each character in input is compared to as it gets parsed using concolic execution. ...
1
vote
1answer
552 views

What is ObjectStublessClientXX in ole32dll?

When I do dynamic reversing I saw usage with ObjectStublessClientXX in ole32.dll . What is that function? What does it do? Is there any way that it supposed to transfer message between 2 processes? ...
2
votes
2answers
679 views

How can I view in-memory strings of a process on Linux (Ubuntu)?

On Windows, I can use tools like Process Explorer and Process Hacker to view in-memory strings generated at runtime of a given process. How can I accomplish this same task on Ubuntu?
1
vote
1answer
301 views

How to watch communication between 2 processes?

I have exe file in my pc(exe1) that send message to another exe (client-server maybe). I dont know which exe recived this message from exe1 and with which iso that message encoding. How can I see ...
3
votes
2answers
299 views

Hybrid binary analysis tool

I have an idea to merge static and dynamic analysis into a visualization through the IDA python scripting interface. The concept involves automatically setting breakpoints at each function or basic ...
2
votes
1answer
96 views

Detect interesting testcases

Suppose I have a ton of test cases and my target is closed-source. Well, I need to know which test cases discover new path in the execution of my target and which are duplicated. I know I have to use ...
7
votes
1answer
260 views

How to detect internal and shared libraries used in an executable file?

Problem: We want to be able to tell with some certainty that specific versions of internal libraries are being used by a program. For example, if a software uses old, deprecated libraries internally. ...
1
vote
0answers
503 views

Hook function in Linux SO file

I'm working on reverse engineering an Android application where the native code opens TLS connections using a built-in copy of mbedtls with certificate pinning. I'd like to decrypt that traffic and ...
1
vote
1answer
722 views

bypassing anti-VM inside protected samples

This is a good starting point. As you know: Sandboxes and virtual environments (hypervisors) are full of artifacts that betray their analysis environment. Malware can protect itself against these by ...
-1
votes
1answer
1k views

Dynamic Analysis on ELF using IDA

On Linux, while generally reversing ELF files and dynamic analyzing (like step into, step over, break-point, inspecting registers value, memory etc) I use gdb or radare2 which provides dynamic ...
1
vote
1answer
2k views

Is it possible to set breakpoints relatively to the memory block in x64dbg or a similar debugger?

Some of my breakpoints perfectly survive multiple restarts. But many interesting parts of the code I am debugging have different locations in memory after a restart. It seems the reason is, that the ...
1
vote
2answers
113 views

Test malware files in host machine?

To analyze malware files we are using virtual machine and virtual box but some of malware detect the environment and will not do its work properly. I want to know how to test malware files with out ...
0
votes
1answer
662 views

How can I circumvent rdtsc when used as an anti-debugger technique?

I using x86dbg and am working on unpacking a target. The unpacking stub appears to be using some anti-debugging techniques - most of which I can detour with a plugin. However, there are a lot of ...
2
votes
1answer
1k views

No apparent entry point for stripped, PIE binary using radare2

I am running on 64-bit Windows 7 and am using radare2 to attempt both static and dynamic analysis of a binary executable. The issue is that I cannot seem to find the entry point of where the program ...
0
votes
1answer
117 views

Configuring a C&C for a RAT [closed]

Where would I start when needing to configure a command and control server for a RAT? So that my dynamic analysis can be more complete. Note: I have been to the topics section of this stack exchange....
0
votes
2answers
3k views

How to unpack and decrypt malware? [duplicate]

Recently I have been working on reverse engineering of binary samples and executables of known malware. Most of them have been packed or encrypted. And to reach the actual data or part of the program ...