Questions tagged [static-analysis]
Static analysis is the analysis code without actually executing it. This is in contrast to [tag:dynamic-analysis] which executes the code.
1
vote
1answer
86 views
Reverse Engineering Flat Data File
I'm writing a piece of software that will take positional data from a piece of software called Pyware and put it into a GUI so I can visualize the coordinates and assign each coordinate a color.
...
1
vote
1answer
49 views
Windbg's “dt” equivalent in IDA?
I wanted to ask whether there is a simple way to see an object's structure (like windbg's "dt" command equivalent)?
Assuming of course I have the pdb file.
Thank you :)
3
votes
2answers
138 views
Hybrid binary analysis tool
I have an idea to merge static and dynamic analysis into a visualization through the IDA python scripting interface. The concept involves automatically setting breakpoints at each function or basic ...
3
votes
2answers
46 views
Finding a particular call to an offset within a vtable using pattern matching
Let's say I have a very simple pattern I'm looking for. E.g. the following regex,
mov.*(eax|edx|ecx|esi|edi), \[(eax|edx|ecx|esi|edi)\+30h\]
Now, I'm also looking for references to this in which the ...
4
votes
1answer
114 views
How to detect internal and shared libraries used in an executable file?
Problem: We want to be able to tell with some certainty that specific versions of internal libraries are being used by a program. For example, if a software uses old, deprecated libraries internally. ...
3
votes
1answer
92 views
Basic hello world stack manipulation troubles
I'm a beginner in reverse engineering, and as a beginner I started to read "Reverse Engineering for beginers".
Here is the hello world program from the book (taken from chapter 3, page 12) :
Now ...
-1
votes
1answer
36 views
Understanding what is represented by function pointers to a block of hex
I'm working on a disassembly project for my class where I'm trying to bypass a license check, but when I throw the executable into Binary Ninja this is what I see:
And when I look at those pointers, ...
2
votes
2answers
62 views
find equation based on multiple sets of 2 variables and results
I'm currently trying to reverse engineer a few equations used in a game, and have collected what seems to be all the relevant data.
In the example below, result speed is definitely based solely on ...
5
votes
0answers
147 views
How to find if a given library function is used in a binary?
Assuming that library X is statically linked, is there a way to know with an acceptable grade of confidence if a function from it was used in the binary?
I am currently using this approach:
Convert ...
0
votes
1answer
189 views
Parsing .rodata (ELF)
IDA pro is able to display the data contained in the read only data section of ELF files, but the section is defined as type SHT_PROGBITS.
To my knowledge, we cannot parse sections of this type to ...
1
vote
1answer
35 views
IDA search results not showing up in a separate window
I'm just learning to use IDA and according to the book, when using Search function (Search>text..., for example) I should see a window with the found results, like this:
However, when the search ...
1
vote
1answer
144 views
Which RE tool is missing?
I am analyzing a malware at the moment which scans for a lot of filenames and ClassNames to recognize if it is under supervision or not.
My problem is, that all the filenames and ClassNames are ...
3
votes
1answer
221 views
No apparent entry point for stripped, PIE binary using radare2
I am running on 64-bit Windows 7 and am using radare2 to attempt both static and dynamic analysis of a binary executable. The issue is that I cannot seem to find the entry point of where the program ...
-2
votes
1answer
70 views
Malware static rules? [closed]
Is there any sites to get static rules to detect malware files?
static behavior rules for detecting malware files.
Thanks in advance.
1
vote
1answer
326 views
Elf file format finding .got and .got.plt segments
I'm writing ELF parser and simple disassembler x86. Having code like this
.text:000B5A2A call 0000B470 ;e.g. _glXSwapBuffers
...
...
got.plt:0000B470 jmp dword ptr [ebx+240h] ;jump to ....
1
vote
1answer
150 views
re-construction of c code: movsx with test instruction
I just started learning about reconstructing C code from assembler instructions.
I have the following piece of assembler code:
mov eax dword ptr [ebp+8]
add eax, dword ptr[ebp-4]
movsx ecx, byte ptr ...
0
votes
2answers
553 views
How to unpack and decrypt malware? [duplicate]
Recently I have been working on reverse engineering of binary samples and executables of known malware. Most of them have been packed or encrypted. And to reach the actual data or part of the program ...
0
votes
0answers
28 views
Weird exception handling stub (or custom code) [duplicate]
I am having trouble reversing the following code segment:
1 push FFFFFFFF
2 push 0a1fbaf99e495555ee71f4abe4aa5a6983bd4e2a.4A7A28
3 mov eax,dword ptr fs:[0]
4 push eax
5 push ecx
...
1
vote
3answers
199 views
Decompress and Analyse VMWARE EFI64 bios
I want to analyse this UEFI bios here. When I open it in IDA it looks compressed to me. Also IDA lists the processor type as ZLOG. Shouldn't this be the multi processor setting for IDA?
Anyway, If I ...
1
vote
1answer
96 views
What are the overall features used in static analysis of malware? Is file property among the features used in static analysis of malware?
I was looking at the paper: "Improved Detection for Advanced Polymorphic Malware" by James Fraley who claimed to have used static, dynamic and file properties for increased malware detection. But is ...
0
votes
0answers
457 views
Why some ppl don't use IDA Pro dbg to do dynamic analysis?
Could someone explain to me why there is so much people stating one should use IDA for static analysis and other dbg to dynamic analysis (ollydbg, x64dbg, etc)?
I'm studying IDA for few months and I ...
2
votes
1answer
137 views
How to detect overlay data in RTF files?
How to detect overlay data in RTF files? When officemalscanner says it detected overlay data, what does that mean ? Is overlay data specific to malicious files ?
5
votes
1answer
235 views
How can I get the shared libraries' function calls using angr
I am trying to get all the library function calls that a binary performs in a preorder-DFT traversal of the CFG. I'm able to get the CFG like:
import sys, angr
import networkx as nx
proj = angr....
0
votes
1answer
3k views
Reverse engineering a golang binary file
I compiled docker by myself with some modifications. I would like to perform some static analysis to the binary. Mostly to see which parts of the code take more memory, etc. It's on linux (elf). Any ...
1
vote
1answer
116 views
What does this sequence of numbers mean?
so i'm reversing a file format of game. As far as i can understand the file i'm trying to reverse contains compressed textures. I'm already able to locate the textures and decompress them, but i'm not ...
0
votes
0answers
58 views
How do you find the value of a Unix time function?
My question relates to a series of lines of code.
I am trying to find the value of eax. I know that the _time function returns the amount of seconds from the epoch time, but I have no idea how to ...
1
vote
0answers
67 views
Where can I get a good description about windows build-in exe programs like wupdmgr.exe?
I was checking the Strings for Lab01-04.exe from Practical Malware Analysis and I found wupdmgr.exe and I face this every time I search for an exe.
Is there any "msdn" alike repository but for exe ...
1
vote
1answer
552 views
Dose PE Explorer unpack upx executables?
I was analysing Lab01-02.exe from Practical Malware Analysis book, the exe is packed with upx, since it showed UPX0, 1, 2 in the header section when analyzed with PEview, but when I open the same exe ...
8
votes
1answer
698 views
Automated Static Unpacking Binaries
I am reading the paper Automatic Static Unpacking of Malware Binaries (Kevin Coogan et al.) with the goal of trying to reproduce the given experimental results (with Hybris-C, MyDoom.q, tElock, etc), ...
0
votes
1answer
247 views
How to get better in re?
I'm a junior security researcher, and I'm interested in improving my ability in RE.
I am a programmer at Assembly and C (and python and a few more high level lang).
I learned and know how to use ...
0
votes
0answers
93 views
X86 Simple semantic similarity analysis
First of all I'm not asking for an implementation or anything, I'm more asking for advice on a course exercise I'm doing. The environment we can use is IDAPython.
So the problem is this, we're given ...
4
votes
2answers
395 views
How to get elf header via IDAPython?
In IDAPython, we can get segments with idautils.Segments().However, the result doesn't cover the whole input file, and the the first segment is ".init". My question is, how to get other things in the ...
-2
votes
1answer
90 views
Need help in understanding the code of a “Malicious” file [closed]
I'm testing a malware sample :
hxxps://www.virustotal.com/en/file/55f4cc0f9258efc270aa5e6a3b7acde29962fe64b40c2eb36ef08a7a1369a5bd/analysis/
This is a malicious executable file. When executed in ...
5
votes
2answers
378 views
Dalvik dex file version 036
I came upon a sample that indirectly contains classes.dex with the magic "Dalvik dex file version 036". If not for the version, the file seems to be normal and JEB loads it without any problem.
But ...
3
votes
0answers
240 views
Is there a static data flow analysis tool for .net assemblies?
I read here that CAT.NET and FxCop are dead. As far as I understand, the successor Roslyn requires a visual studio project and source code.
Is there a tool that reads in a compiled .NET program and ...
8
votes
1answer
205 views
Is there a way to find out which hash standard by studying the source code?
We have an embedded product, which we are carrying for several hardware iterations since more than 5 years ago. We have all the source code, most of it nicely documented. As the product is actively ...
1
vote
1answer
2k views
Are there any static binary rewriting tools？
My goal is to modify some instructions and make some instrumentation in ELF executables or libraries(For example, modifying all memory writes instructions). Since there're so many instructions, I want ...
0
votes
0answers
458 views
Getting the address of variables in IDA
I have done most of my reverse engineering/decompiling/etc in Cheat Engine. However, the particular program I am trying to analyze shuts down when I search its memory for values. Thus I can only ...
0
votes
2answers
143 views
Identifying a very weak hash algorithm
I'm reverse-engineering a string translation file format for a particular game. It's ultimately just an ID-to-string map, where the IDs are four-byte integers. There are 1935 IDs in total; you can see ...
3
votes
1answer
84 views
How would one find test cases for a self-implemented value set analysis (VSA)?
I read a blog post about value set analysis (VSA). For VSA, see e.g. here.
The blog author writes
I’ve been trying to get to the point where the example in
Balakrishnan’s dissertation works. I ...
2
votes
2answers
234 views
Programmatically reverse-engineering a dynamic dispatch method
Background: I want to convert Qt RTTI into symbols, to more easily navigate a large executable.
If you don't know already, Qt is a C++ application framework based on a message passing system. Since C+...
1
vote
2answers
128 views
Automated Branch Input Generation
Theoretically it should be possible for a binary analysis tool such as IDA to generate an input that will trigger a specific branch patch. So for example an executable that takes in a command line ...
0
votes
1answer
98 views
Get driver binary
I am running an application that just after starting, it creates a service (process hacker tool notifies me that driver_app.sys has been created). Indeed, it says that the location of driver_app.sys ...
8
votes
3answers
2k views
Control flow graph reconstruction projects
I'm looking for projects providing reconstructed Control Flow Graphs from binaries while supporting more than one platform (e.g. x86, x64, arm). For example, considering this short assembler program:
...
0
votes
0answers
121 views
Can I list API call sequence using IDA Pro?
I want to create graph of API call sequence. API call sequence may can get by using dynamic analysis which it show the time when call API , but I think API call sequence can be call in parallel. If it ...
1
vote
1answer
185 views
IDA Hex-Rays Generating Redundant Code
Hex-Rays generated C code is adding a lot of redundancy code, and I cannot figure out why and it really frustrates me to remove them manually on my reverse engineering process.
if ( v1 )
{
v15....
3
votes
1answer
459 views
Resolving symbols of statically linked libraries in a binary
assuming i got an statically linked libraries (for example, openssl) inside some binary.
What is a good way to resolve the library symbols ? is there any IDA plugin for that job?
I presume that I ...
1
vote
2answers
167 views
Obfuscation by changing the order of a malware behaviour
I know that there are some obfuscation techniques which can lead to slowing or even failing the detection of malware when static analysis is used.
However, is there a similar technique that changes ...
0
votes
1answer
216 views
What is the relationship between the Windows API and the C run time library? [closed]
I have two reports of static and dynamic malware analysis. There are some APIs of MSVCRT's dll in my static report, which are missing in the dynamic report. (such as _p_commode, _setusermatherr, etc.)
...
1
vote
1answer
571 views
How to search sequence of API call using IDA Pro?
I want to search the sequence of API call using IDA Pro. How to search the API call node execution and what is the next API call node execution followed using IDA Pro.
