Questions tagged [static-analysis]
Static analysis is the analysis code without actually executing it. This is in contrast to dynamic analysis which executes the code.
207
questions
0
votes
1
answer
46
views
How to detect incorrectly named DLL?
I am trying a simple lab on malware analysis and we were given both an .exe and .dll file.
However, I am told that the DLL will need to be renamed to something for it to work.
How do I go about ...
- 1
0
votes
1
answer
122
views
Identifying rating algorithm
I'm trying to identify the rating algorithm used to calculate the displayed average of a 1 star to 5 stars rating system. To analyze the data I collated the first and last 1000 ranks and added the ...
- 1
0
votes
0
answers
21
views
Binwalk, what's advantage of "Show results marked as invalid"?
I'm trying to understand -I option in binwalk. It provides some interesting output yet it isn't clear if these results are "invalid" or if they are valid results of a special type.
DECIMAL ...
- 123
2
votes
1
answer
121
views
Split variable in Ida Pesudo Code
Sometime the meaning of variable has been changed on the function.
For example from Ida pseudo code:
a = price
....
a= tax....
In the beginning of function a was price and after that a is tax.
How ...
3
votes
1
answer
177
views
What is "nullsub_XXX" in vtable in IDA
When I looking in a vtable structure in IDA pro, I know that ___cxa_pure_virtual means that the function is virtual.
But what does nullsub_XXX mean in a vtable structure?
- 173
0
votes
0
answers
33
views
Tools to generate code to hidde hardcoded critical data
I have retrieve a code file related to security topic, that contains a piece of code to protect harcoded value of RSA key against static analysis:
// Byte values of encrypted key
//121, 217, 79, 9, ...
- 1
0
votes
2
answers
67
views
Not Understanding the FU540 Boot Process
I'm reading the manual for the SiFive FU540-C000 trying to understand the boot process, and I'm not making sense of the initial steps after power on.
I'm using MSEL = 1111 based on the recommendation ...
1
vote
0
answers
161
views
Pascal string representation in Hex-Rays Decompiler of IDA Pro
I'm trying to prettify a representation of Pascal-string "Could not access file "" in Hex-Rays decompiler's output. As you can see below,
now its type is char[25] due to inclusion of ...
- 11
1
vote
1
answer
147
views
Ida Pro doesn't recognize known function
I open statically Arm binary with Ida Pro.
While I reversing I find out some function like strstr and memcpy and etc. That Ida doesn't understand that those function are strstr and memcpy(for example)
...
0
votes
1
answer
140
views
How do I interpret this double offset?
While looking at that old game I've found a class CStr that is used in an unusual (to me) manner. Most of the times a member of CStr is used, it's done as follows. In both cases, this is a CStr *.
...
- 149
0
votes
1
answer
190
views
What does this function do?
I'm trying to understand what client sends to server. I already did most of the work, but one function left. I can't understand what to do with this function and what it does. I've tried to change ...
- 1
0
votes
2
answers
111
views
Format of data in the .code/.text section
I'm attempting to dissect/disassemble a windows PE file under Linux using objdump. On surface analysis, the .code section was disassembled to :
tmp.exe: file format pei-i386
Disassembly of ...
- 125
1
vote
0
answers
96
views
IDA script: How to properly undefine a byte and then redefine code
I'm trying to correct the following instructions in IDA using a script:
jnb short near ptr loc_1C61B1+3
It order to do this I'm running a snippet like this in a script:
ida_bytes.del_value(...
- 103
3
votes
1
answer
96
views
Determine if the function has try/catch statement via the static analysis
I need to determine if the function has exception handler via static analysis. Initially I thought that if there's SEH handler prolog in the function, then the function should have try /catch. I.e. I ...
- 1,750
0
votes
0
answers
32
views
Can you strip a mips64 object file?
-strip doesn’t know what this file is but read elf and objdump recognize it read elf gives entry and all the headers. I’m trying to find main() or the start function. Can I strip the file? Do I need ...
2
votes
1
answer
260
views
Help regarding XOR game decryption algorithm
I'm currently trying to reverse engineer the decryption algorithm for an old online game, using a chat message packet, as it contains text which is easily recognizable.
I used a packet sniffer to get ...
- 23
0
votes
1
answer
95
views
Why might nm find a few undefined symbols that I can't see with xxd?
I'm cross-comparing a few approaches to testing for binaries that import a symbol and I noticed a YARA rule not finding one in sudo that nm + grep could find.
I looked at it in xxd to figure out why, ...
- 103
1
vote
1
answer
161
views
Arrays assembly
I'm reversing my C array's programs where I'm storing numbers in arrays like this...
int marks[5];
marks[0] = 1;
marks[1] = 3;
marks[2] = 2;
marks[3] = 7;
marks[4] = 9;
so the compiler showing me the ...
- 323
2
votes
2
answers
150
views
Why this ASM represents Virtual Function call?
I'm referring to this question that was asked previously:
Virtual functions call asm
I'm wondering how is it possible to know whether this ASM listing represents Virtual Functions calls? What's in the ...
- 138
2
votes
1
answer
202
views
Not able to understand the C-switch statement in disassembly
While I'm trying to disassemble my own C code I am stuck in a problem of not understanding how this Switch statement is implemented in assembly code. Can anyone please help to figure it out? This the ...
- 323
0
votes
1
answer
295
views
Difference between \n, \0, \x00 and data from /dev/zero when performing a buffer overflow?
I am working with a binary that involves a buffer overflow on two contiguous memory blocks allocated with malloc. The binary filles up the first buffer with whatever the user inputs and hardcodes the ...
0
votes
0
answers
184
views
Using GDB to find the address of a buffer in a stripped C binary
I am working with a crackmes binary called Simple Overflow. It has two buffers with sizes 0x10 and 0x8, and it uses malloc to allocate two contiguous memory blocks (see <+25> and <+39> on ...
0
votes
1
answer
78
views
How to simplify a function "calling itself's reference"
I encounter often a function calling itself (in the pseudo code) such as:
result = (**(__int64 (__fastcall ***)(volatile signed __int32 *))lambda)(lambda);
Since the disassembly is call qword ptr [...
- 123
0
votes
1
answer
75
views
Is it possible to make a dynamic memory allocated .data segment to static in a file?
Sorry if this is a dumb question I'm new to assembly.
Basically I want to modify a function in a .exe file to return with a different data, but my issue is that the memory location of the data segment ...
- 3
3
votes
2
answers
106
views
How to figure out functionality when doing Static Code Analysis in ASM?
When doing Static code analysis on a disassembled app, I usually end up seeing many calls to registers (CALL EAX for example), which is constructed in runtime, which leaves me clueless on how to ...
1
vote
2
answers
119
views
Lifting exported function instructions in PE files
I am trying to automate analysis of instructions within exported functions for a .DLL and need to be able to lift the first few instructions for the entry point of each exported function statically ...
- 11
1
vote
4
answers
219
views
finding sequence of opcode in binary
I have dis-assmebled binary and want to check if it contains particular sequence of opcodes(obtained from other reference binary). how to do that . i know plain byte
level comparison wont work as as ...
- 11
0
votes
1
answer
131
views
How can I find a value in Tricore(TC1766) Arch?
I recently work on Tricore Processor, but I have some problems.
With reading memory value. I do not know if I am right or not, but I think a part of flash memory copied to RAM and now in my algorithm ...
- 87
1
vote
0
answers
146
views
Delphi mt38 CRC (Tricore 1766 Arch)
I want to calculate CRC32 for Delphi mt38 and found the below assembly algorithm and converted it to C. It seems that this algorithm is defined for n = 256 or 1024. I want to calculate CRC32 for n = ...
- 11
3
votes
0
answers
33
views
How can I tell whether or not a given library method is being referenced by a consumer program statically in OOP languages?
Preface: This question is about source code reverse engineering and static analysis. Meaning, there is no built code available but I have access to the source code of the program.
Imagine I'm looking ...
- 1,625
1
vote
0
answers
127
views
CRC16 Reverse in C166 Arch
Before that I asked about piece of code that used in this algorithm (here). Now I have a bit problem with the rest of algorithm.
So I have to describe this with detail. Sorry if i vast your time for ...
- 87
0
votes
1
answer
315
views
Static Binary in Windows
I am learning more about binary exploitation on windows. But I saw while revering a binary that you can create static binaries in windows too just like in Linux. It was really ugly. if I would be on ...
- 143
1
vote
0
answers
43
views
Strange memory allocation behaviour
I'm currently working on a modding library for a particular game, and I have come across a part of the menu system that I can't figure out the purpose of.
The expression in question is this:
unsigned ...
- 23
0
votes
1
answer
72
views
Password evaluated from the sum of ASCII letters
After analyzing the code, I have been able to understand and recreate the algorithm used to check if the password the binary takes is correct, but don't know how to solve it (or at least can't think ...
- 3
-3
votes
1
answer
314
views
The C166 family code meaning
What the meaning of this code with an explanation?
sub_37C2:
mov r5, r4
shr r5, #14
shl r5, #1
mov r5, [r5+0FE00h] ; DPP0
bmov r4.14, r5.0
bmov r4.15, r5.1
shr r5, #2
rets
; ...
- 87
0
votes
2
answers
157
views
Is manually converting/decompiling x86 source code to C/C++/etc... considered reverse engineering?
I have the source code of an old program written in 32-bit x86 assembler that I am working on manually rewriting in C.
The first time someone asked me about this project I told them I was 'reverse ...
- 133
1
vote
0
answers
62
views
Statically injecting translated NASM assembly into existing ELF binary
I'm trying to statically patching ELF binaries in order to incorporate code that can help provide run-time protection.
In an effort to save time writing and debugging assembly, I took the following no-...
- 111
1
vote
0
answers
63
views
Immediate offset LDR in presumed malloc function looks wrong in static analysis
I am attempting to disassemble a ROM image for a BCM4366C [1] after reading a blog post where researchers reversed some other Broadcom chips [2] . I have analyzed the ROM image in Ghidra and I have ...
- 31
0
votes
1
answer
43
views
What is this line and how to remove it
I tried to unpack packed_dll, when the unpack stage done, i dumped unpacked_dll out and start to reverse. I pretty sure this is continuously function of that dll but this line show up. So what is this ...
- 57
-1
votes
1
answer
136
views
How can I analyze this code? [closed]
I wanted to analyse the code for some functionality.
in my understanding the code contains a logic handling intents with extras. I want to know how these Works! and also how can I pass extras using ...
- 179
1
vote
0
answers
212
views
Removing/bypassing a BIOS whitelist
I am trying to bypass or erase the BIOS whitelist on my Thinkpad T440p. So far I've
used flashrom and a soic8 clip to dump the bios to a bios.img file
made another dump and compared with diff bios....
- 11
0
votes
1
answer
296
views
ida identifies library function as regular function
I'm trying to find libc symbols in some Windows 32-bit application. For some reason, Ida autoanalysis didn't recognized code that comes from libc as "library function", but as a "regular function". ...
- 103
1
vote
0
answers
125
views
ARM chip gpio/ identification from firmware code
Device: i was able to recover bricked Chinese IOT a Sous Vide cooker. Replaced damaged capacitor. it works.
it has
ARM soc/mcu/processor
WI-FI (broadcom)
LCD touch screen + 16bit STM mcu.
EEPROM ...
- 11
1
vote
1
answer
101
views
methods that have zero usage in jadx?
so i've been reversing this ai assistant app to figure out what kind of forensic data it leaves on local file system. during static analysis with jadx-gui i found some interesting methods that take ...
- 11
1
vote
1
answer
556
views
Dynamic analysis (Frida) reveals instance of a class that doesn't exist in the source code (dex2jar)
I have been diving into an apk's source code, doing both static analysis with Jadx (same as dex2jar) and dynamic analysis with Frida.
I am trying to replicate the method that signs HTTP requests "...
- 13
0
votes
0
answers
41
views
static analysis for identifying backdoors
I am doing a research in identifying backdoors in windows .exe files. Currently I found some methods to detect.
1.String search in .exe
2.find Reffrence .dll and win32 Api calls using import table
...
0
votes
1
answer
2k
views
Find functions signatures in Ida?
I didn't understand the subject of find function in Ida via signature.
If I understand well that way helps to recognize libraries functions in static binary(in dynamic binary I can see the functions ...
0
votes
1
answer
109
views
PE file export functions of packed file
I am new to reverse engineering and I am learning about packed files.
I saw that most of the time I can recognize a packed file with a little number of import functions in PE file and not many strings ...
- 123
1
vote
1
answer
536
views
Find all syscall in statically Arm Binary
What is the easy and fast way to find all syscall in statically Arm binary ?
Is there any Ida plugin that do that?
0
votes
0
answers
48
views
Python based static c analysis tools
I want to analyze some open-source C code, and I'm looking for a static analysis python library for C, preferably open-source. Any ideas/suggestions, based on your experience?
- 1,748