Questions tagged [dynamic-analysis]

Analysis of a piece of code by letting it run (fully or step-by-step) on a real system or in a virtualized environment, as opposed to static analysis.

Filter by
Sorted by
Tagged with
1
vote
1answer
562 views

Call Android method without running whole Android-App

I want to ask if somebody is aware of tools/projects which are similar to the Appcall feature of IDA Pro[1] for Android Apps? I'm looking for the possibility to run certain methods detected in the ...
1
vote
0answers
500 views

OllyDbg step over command not behaving exactly as the Immunity Debugger

I am taking Lena Reverse Engineering Tutorial and it uses OllyDbg debugger for its teaching. In the first chapter, he shows the file in OllyDbg debugger and steps over through it "step by step" until ...
0
votes
1answer
237 views

What is the relationship between the Windows API and the C run time library? [closed]

I have two reports of static and dynamic malware analysis. There are some APIs of MSVCRT's dll in my static report, which are missing in the dynamic report. (such as _p_commode, _setusermatherr, etc.) ...
6
votes
1answer
3k views

Unicorn and QEMU: Example use cases to understand the differences

The Unicorn website lists some differences between Unicorn and QEMU, especially those differences "where Unicorn shines". They furthermore write: A notable difference between Unicorn and QEMU is ...
1
vote
1answer
902 views

How to get the runtime memory region information when instrumenting using Pin?

I am using Pin for some execution monitoring tasks towards x64 ELF binary code. During the monitoring, for any memory write/read operation of the original code, I would like to record it as long as ...
2
votes
3answers
234 views

Dynamic instrumentation tools which support reverse execution

I am trying to analyze some execution crash information, and to better identify the root cause of memory access error, I would like to reverse execute the program from the crash point. For example, ...
2
votes
2answers
313 views

Dynamic analysis of malware samples

I have thousands of Linux malware samples in ELF format. And I am thinking to use dynamic analysis (say, PIN) to obtain an execution trace of each malware sample. However, I am afraid such activity ...
2
votes
1answer
653 views

Analyzing a Login Process

I am reverse engineering a program that uses a custom auth protocol. This is a basic outline of the process: Client takes input for username and password, then sends username to the auth server. Auth ...
1
vote
3answers
1k views

Configure and execute Intel's PIN Tool

I am trying to develop a Pintool on Windows. But so far I have been unable to configure or execute PIN. I have Microsoft Visual Studio 10.0 installed on my system. I have also downloaded and unzipped ...
1
vote
1answer
117 views

Different basic block count when running application several times

I've been testing DynamoRio and minblox to do coverage analysis, and I've got a question, when I run a the bbcount sample on ping.exe (not passing parameters) several times, I get different count of ...
0
votes
1answer
115 views

What is the difference between Intrusive Attaching and Non-Intrusive Attaching when debugging?

In Core Debugger Concepts What is the difference between Intrusive Attaching and Non-Intrusive Attaching when debugging?
1
vote
1answer
619 views

Variable's position on stack

I wanna create a script/program that will modify value in memory of another process. With GDB I've discovered that variable I want modify is located on heap. Because this variable is create ...
1
vote
1answer
132 views

Capstone Disassembly Engine Issue: OP_Access throws TypeError

After installing the Capstone python module, I ran this example on a Win7x86 PC with a minor edit (added arch and mode). However, when attempting to use insn.regs_access(), it throws a NoneType ...
0
votes
1answer
872 views

Any tips for analyzing this mips function

These function are used to decrypt with AES and there is Decrypt by CRC and I assume that crc is used for data checksums, I have qemu-mipsel and my question for u is how could I discover from where ...
2
votes
2answers
1k views

Generating call graph for assembly instructions

I'm writing a tool and I need to generate the callgraph for assembly instructions. But I do not know how to exactly generate call graph from assembly instruction. Do you have any idea? To clarify, I ...
9
votes
1answer
323 views

Saving program execution state for fuzzing

Suppose I have a program that has two functions, functionA and functionB called sequentially. functionA requires a significant amount of processing in order to execute, and in the course of the ...
1
vote
2answers
659 views

identify packer compression or encryption algorithm

I do have an executable packed file. I want to detect compression or encryption algorithm dynamic and static ways separatly; of course without signature base way. How can I detect compression or ...
1
vote
1answer
95 views

How can I recover / locate non-virtual class methods at run-time?

I know how to find and hook virtual methods by crawling an object's RTTI. I cannot find enough information about non-virtual class methods. Is there anyway to identify non-virtual class methods at ...
3
votes
1answer
444 views

How should I approach debugging a PE which create a large database?

I am reversing several modules which are dynamically and statically linked into an executable. I have started learning active analysis by attaching one of my database files to the win32 exe using the ...
6
votes
1answer
308 views

Use of SSA (Single Static Assignment) while dynamic analysis

I have read that dynamic instrumentation can be done using tools like PIN or Valgrind. However Valgrind provides intermediate representation and converts the binary into SSA which makes it more ...
4
votes
1answer
1k views

Dynamic instrumentation tools

I've discovered recently PIN which allows to dynamically instrument the binary code while still making the program believe it is running unmodified. Even more recently, I've heared about Dyninst and ...
1
vote
1answer
248 views

Where can I learn about code instrumentation?

Currently I am learning about profiling parallel programs. All the profilers heavily use all kinds of instrumentations but this topic is not well explained. Do you know any good sources from which I ...
3
votes
2answers
360 views

How to find location of environment variables in 64 bit binaries at runtime?

In the main function, program authors can choose to receive the char * array as a parameter to main that points to the environment variables int main(int argc, char **argv, char **envp) { ... } The ...
1
vote
0answers
123 views

How to find maximum and minimum process boundaries while debugging?

If I'm using GDB or any other debugger, I just want to know where the respective images are loaded for a given process. Say I create an executable HelloWorld, and it just prints hello. It has a ...
4
votes
1answer
683 views

Finding execution flow/calls to functions?

I have a binary and I'm interested in an high level overview of how it operates. I was trying to generate a list of functions called during a particular execution, with their hierarchy, for example ...
3
votes
1answer
1k views

Windbg: going from vftable to c++ class

As part of an assignment, I am delving into the world of Internet Explorer, and am trying to figure out exactly what class(es) are being allocated on the heap. In the mshtml!CEventObj::...
1
vote
2answers
267 views

Log all client requests? [closed]

I'm working with Burp 1.6. Intercept is off, and I want to log all client requests. Visiting Burp's help page on logging page, there's supposed to be an Options tab or Misc tab (I can't quite ll ...
1
vote
1answer
2k views

Debug httpd process

I'm attempting to inspect memory of an httpd binary compiled statically with openssl. When I list the httpd processes, I get: $ ps aux|grep httpd root 58539 0.0 0.7 75364 3740 ? Ss ...
1
vote
1answer
287 views

Tracing adware on windows - ads showing up in browser

Sometime ago I came across this situation: Windows 7 machine infected with adware, ads tabs opening up in chrome out of nowhere. Pretty invasive stuff. In the end i got rid of it with some malware ...
0
votes
1answer
127 views

What is the relation between binary (executable) instructions and execution instruction [closed]

What I want to know is that is there any similarity or may be difference between a binary instructions and an execution instruction of a binary ? In other world, in area of malware analysis a binary ...
1
vote
0answers
603 views

How to get frame sync signal from a GoPro Dual HERO System sync cable? [closed]

I need to frame sync a GoPro Dual HERO System with an external data logger. So the main problem is to get the HERO frame synchronization signal (I guess there must be one in the cable) from their ...
3
votes
1answer
4k views

Are there any Windows alternatives to INetSim?

I found a tool for Linux called INetSim which emulates services such as HTTP HTTPS IRC and many other. It is often used to trick malware. The problem is that INetSim works only on Linux. So I want ...
14
votes
2answers
4k views

Using QEmu monitor interface to extract execution traces from a binary?

My original point was to build something a bit more powerful and generic than a PTRACE system call for Linux platforms. The problem with PTRACE is that it only run on your own system and architecture. ...
3
votes
2answers
2k views

Automated Assembly/Disassemble library

I'm writing a handy reverse tool in C++ with manual assembling/disassembling shell, to automate my work! I need an assembler library. Is there any library, embedding in C++?
2
votes
0answers
177 views

Malware terminated in Ollydbg after a while - Why? [closed]

I try to analyze a backdoor program with ollydbg. When I go through the assembly code by clicking the "Step Over"-Button, i stop sometimes to make a notice on a paper. Later when i want to go trough ...
3
votes
2answers
712 views

IDA - save work on kernel mode debugging

I'm working with IDA pro on a kernel mode function (VMware + windbg) and I'm a annoying because I can't save the workstation state. IDA crash after 3 hours when I "quit and save memory status". Is ...
-1
votes
1answer
387 views

Kernel Driver Execution Flow ( Faster Than IDA or BinNavi )

Is there any tool help my to draw kernel-mode execution flow graph (basic block based or function based) ? My exact problem is slow speed. To clear my question lets ask this way: Is there any fast ...
3
votes
2answers
6k views

DLL - Dynamic Analysis on IDA

I'm "middle-new" in re and I have to debug a dll's function. How can I tell to IDA : start function XXX with parameters A, B and C ? Is there a solution or a plugin doing that ? I've tried doing that ...
1
vote
2answers
599 views

What is the address of main() and how many bytes does it allocate on the stack for its frame size?

Here is my objdump -d output but I do not know where to look. I understand assembly but it is a little confusing trying to find out what the values of registers are at certain points. If anyone knows ...
6
votes
2answers
6k views

How do I view external function calls in dynamically linked ELF binary in linux?

I used the file command in Linux to get information about a binary file. I am also looking for the addresses that these calls are located at. I think I can get this information from GDB or objdump but ...
2
votes
1answer
1k views

IDA PRO Basics For Hex Rays How to fix address to struct which is dynamically calculated in if statement

I barely know any assembly and just started using IDA PRO a few months ago. I understand the code that Hex-Rays generates pretty well and I think I know why Hex-Ray's fails to create a struct of this ...
2
votes
2answers
2k views

Windbg x64 setting breakpoint

My issue is all about setting the breakpoint on x64 Windbg. For x86 to combine IDA and Windbg analysis nothing is required. Just copy and paste the IDA address value and it works just fine. For ...
6
votes
3answers
807 views

Is there any Dynamic Binary Instrumentation frameworks for Windows exposing an Intermediate Representation?

There are some excellent DBI frameworks for Windows (Intel PIN, DynamoRIO...) but unfortunately none of them expose an IR afaik. I am looking for something like Valgrind's VEX that works on Windows. ...
2
votes
4answers
693 views

Reverse engineering close sourced JSP applets

I have a web application written in JSP running on a tomcat 6 server that I want to RE. I've decompiled the .jars associated with the web application. The source code is heavily obfuscated, making it ...
8
votes
3answers
2k views

Re-engineering to create UML Diagrams from Source and Binary

Are there tools that would create: UML Structural Diagrams from Source Code. UML Behavioral Diagrams from Binary executing on a arm / x86 system. Sources would be in C &/ C++ &/ Python. ...
10
votes
1answer
782 views

Static analysis data combined with dynamic analysis knowledge

What I'm doing now is placing an awful lot of comments about function variable values, global variable values as comments in my IDA database, which I find ugly after a while and obviously not a best ...
4
votes
1answer
1k views

vtrace / vivisect resources

Where can I find some resources to start learning about vivisect? Blog posts, presentations, PDFs, code examples, anything would be appreciated. I am aware I can read the code but before doing that ...
3
votes
0answers
372 views

How to quickly/easily make an analysis (reverse engineering) of the code of unknown CMS or framework on PHP? [closed]

I would like to know what tools and techniques do you use for rapid analyze of unknown code CMS or framework. If more specifically that for the following tasks: 1. To locate the file (s) html ...
8
votes
1answer
2k views

What is MSR Tracing?

I was reading a old blog post on OpenRCE that mentions MSR tracing in the context of binary only profiling and coverage. The only Google hits for this term are a few emails on the Xen mailing list ...
1
vote
0answers
52 views

What are possible ways to dynamically analyze windows service? [duplicate]

I am working executable, which is meant to be loaded as windows service. I have statically determine certain breakpoints that I'd like it to break upon execution. Is there any particular way to ...