Questions tagged [dynamic-analysis]

Analysis of a piece of code by letting it run (fully or step-by-step) on a real system or in a virtualized environment, as opposed to static analysis.

Filter by
Sorted by
Tagged with
0
votes
1answer
72 views

Debug process that use /dev/watchdog

I want to debug a process with gdb into Linux system, but the problem is that process pings /dev/watchdog so when I tried to debug it, it stop the process for longer than the watchdog interval so the ...
0
votes
1answer
136 views

x64dbgpy: application unresponsive when trying to automate inside breakpoint callback

When a breakpoint callback is triggered trying to automate the debugger inside the callback causes the application to become unresponsive. x64dbg continues functioning but the application itself doesn'...
0
votes
1answer
3k views

How do I find the address of a data location at runtime?

I'm using ghidra and cheat engine to reverse engineer a game's function. In ghidra's decompiler this function references two locations known as _DAT_XXX. I know the addresses of these locations in the ...
0
votes
2answers
284 views

How to perform memory address translation on x86 instructions?

I have a mechanism that maps memory addresses to other memory addresses, e.g.: { 0x10000 -> 0xA0000 0x20000 -> 0x99000000 0x340000 -> 0x50000000 ; Stack in this example } Some example ...
0
votes
1answer
694 views

Dynamic Analysis Detection

Suppose you want to conceal an application's true purpose from analysts by reacting to dynamic analysis tools. How is it possible to detect running (in debugger mode) the application under a reverse ...
0
votes
1answer
133 views

What is the difference between Intrusive Attaching and Non-Intrusive Attaching when debugging?

In Core Debugger Concepts What is the difference between Intrusive Attaching and Non-Intrusive Attaching when debugging?
0
votes
1answer
132 views

What is the relation between binary (executable) instructions and execution instruction [closed]

What I want to know is that is there any similarity or may be difference between a binary instructions and an execution instruction of a binary ? In other world, in area of malware analysis a binary ...
0
votes
0answers
20 views

How to keep track of Dynamic Variables

The thing I'm trying to reverse has a lot of variables on allocated memory so I can't comment and keep track of the addresses as every time I re-run the software they will be different.. I'm working ...
0
votes
0answers
21 views

How to extract an AutoIT script when tools fail to extract it?

Lets say you have a Autoit malware (windows executable, autoit v3), and you want to extract the script from it. But tools such as exe2aut fail to extract it. What would you do? is there any place in ...
0
votes
0answers
41 views

What is the difference between a file on disk and a file on memory?

Currently, I am learning about the differences between static and dynamic analysis. I have come across this incredible question that has been bugging me: What happens to the file (in memory) when you ...
0
votes
0answers
29 views

Can I find out what methods are being swizzled in runtime?

I have an obfuscated dylib injecting into a process in macOS to swizzle objc methods. Obviously I can decompile it to check what it is hooking, but its heavily obfuscated. Hence, can I find out what ...
0
votes
2answers
397 views

CaptureBAT equivalent on Windows 10?

Hello RE community on stack ! I am a beginner, so please pardon any commonplace errors I am looking to run CaptureBAT on a Windows 10 VM, to capture network activity of different kinds of Malwares I ...
0
votes
1answer
63 views

Is it possible to make a dynamic memory allocated .data segment to static in a file?

Sorry if this is a dumb question I'm new to assembly. Basically I want to modify a function in a .exe file to return with a different data, but my issue is that the memory location of the data segment ...
0
votes
0answers
53 views

Pin DBI tool - Create executable

I'm starting to learn Intel's Pin framework and I can't figure out if it's possible to create an executable. I mean, rather than creating a module and forcing people to download Pin + the module, is ...
0
votes
0answers
24 views

Jumping to a specific logation for DLL injection : OllyDbg

Hypothetically, If I'm hijacking a DLL but user space is in a sandbox; upon debugging, sandbox initiates at 0x345678 and I want to move to the space before it initiates: Can I call a jmp function ...
0
votes
0answers
61 views

Forcing embedded libcurl to disable SSL verification

I am trying to decrypt HTTPs communications in a binary that I know has been statically linked with cURL. How can I force curl to not verify SSL certificates for fiddler to intercept? I am using the ...
0
votes
1answer
212 views

frida - The specified child already has a parent. You must call removeView() on the child's parent first when hooking, how do you solve it?

I wanted to hook the method A1f in the below code but frida returns the following exceptions: Found instance: MyHomeFragment{9bbd8d5} (0965bca9-4838-4ca1-a835-d99639ae15f1)} java.lang....
0
votes
1answer
137 views

Get function return value

Any idea for more ways to get return value? (No hooks, no hw/memory breakpoints, no call functions). thx :) I tried to find a dword maybe that hold the function return, but I didn't find it. I'm ...
0
votes
1answer
2k views

How can I dynamically debug a malicious DLL? [duplicate]

English isn't my first language, So I will do my best ) I am trying to analyze some malware NotPetya and I can run the malware by running : rundll32.exe notpetya.dll #1 I am using Olly and trying ...
0
votes
1answer
117 views

Configuring a C&C for a RAT [closed]

Where would I start when needing to configure a command and control server for a RAT? So that my dynamic analysis can be more complete. Note: I have been to the topics section of this stack exchange....
-1
votes
1answer
432 views

Kernel Driver Execution Flow ( Faster Than IDA or BinNavi )

Is there any tool help my to draw kernel-mode execution flow graph (basic block based or function based) ? My exact problem is slow speed. To clear my question lets ask this way: Is there any fast ...
-1
votes
1answer
88 views

Break when exe send tcp packet

When I debug exe file with Ida I want to put breakpoint before the exe file send tcp packet. When I listen with procmon I can see that this exe send and recive tcp packet. 1) I look on the exe file ...
-1
votes
1answer
2k views

How to find functions in IDA Pro/x64dbg

i created a program for testing, very simple in c++. is ask for password if it is match is print correct, if no it is print "bad". i try to find with ida where is the function of what i made. but i ...
-1
votes
1answer
1k views

Dynamic Analysis on ELF using IDA

On Linux, while generally reversing ELF files and dynamic analyzing (like step into, step over, break-point, inspecting registers value, memory etc) I use gdb or radare2 which provides dynamic ...

1 2
3