Questions tagged [static-analysis]
Static analysis is the analysis code without actually executing it. This is in contrast to dynamic analysis which executes the code.
177
questions
0
votes
0answers
15 views
Statically injecting translated NASM assembly into existing ELF binary
I'm trying to statically patching ELF binaries in order to incorporate code that can help provide run-time protection.
In an effort to save time writing and debugging assembly, I took the following no-...
0
votes
0answers
15 views
Symbols for detecting UBSan
I am looking for the symbols that reveal if a specific binary was compiled with UBSan.
Unfortunately, Checksec is not able to detect it.
So, I have compiled the snippet reported in the official doc.
...
1
vote
0answers
47 views
Immediate offset LDR in presumed malloc function looks wrong in static analysis
I am attempting to disassemble a ROM image for a BCM4366C [1] after reading a blog post where researchers reversed some other Broadcom chips [2] . I have analyzed the ROM image in Ghidra and I have ...
0
votes
1answer
33 views
What is this line and how to remove it
I tried to unpack packed_dll, when the unpack stage done, i dumped unpacked_dll out and start to reverse. I pretty sure this is continuously function of that dll but this line show up. So what is this ...
-1
votes
1answer
97 views
How can I analyze this code? [closed]
I wanted to analyse the code for some functionality.
in my understanding the code contains a logic handling intents with extras. I want to know how these Works! and also how can I pass extras using ...
1
vote
0answers
47 views
Removing/bypassing a BIOS whitelist
I am trying to bypass or erase the BIOS whitelist on my Thinkpad T440p. So far I've
used flashrom and a soic8 clip to dump the bios to a bios.img file
made another dump and compared with diff bios....
0
votes
0answers
109 views
What are the known techniques used by wrappers and obfuscators to protect against decompiling?
I am NOT looking to make my application 99% safe, nor my goal is to prevent a a determined reverse-engineer to disassemble it, but simply is to protect my source code from lambda user with little ...
0
votes
1answer
48 views
ida identifies library function as regular function
I'm trying to find libc symbols in some Windows 32-bit application. For some reason, Ida autoanalysis didn't recognized code that comes from libc as "library function", but as a "regular function". ...
1
vote
0answers
42 views
ARM chip gpio/ identification from firmware code
Device: i was able to recover bricked Chinese IOT a Sous Vide cooker. Replaced damaged capacitor. it works.
it has
ARM soc/mcu/processor
WI-FI (broadcom)
LCD touch screen + 16bit STM mcu.
EEPROM ...
1
vote
1answer
28 views
methods that have zero usage in jadx?
so i've been reversing this ai assistant app to figure out what kind of forensic data it leaves on local file system. during static analysis with jadx-gui i found some interesting methods that take ...
1
vote
1answer
65 views
Dynamic analysis (Frida) reveals instance of a class that doesn't exist in the source code (dex2jar)
I have been diving into an apk's source code, doing both static analysis with Jadx (same as dex2jar) and dynamic analysis with Frida.
I am trying to replicate the method that signs HTTP requests "...
0
votes
0answers
37 views
static analysis for identifying backdoors
I am doing a research in identifying backdoors in windows .exe files. Currently I found some methods to detect.
1.String search in .exe
2.find Reffrence .dll and win32 Api calls using import table
...
0
votes
0answers
33 views
Is there any tool that finds common things like strings among large number of binaries?
So this is really needed in malware analysis, for example if i have 1000 samples from a family and i want to know which strings are common among all of them, it would really help to have a tool that ...
0
votes
1answer
64 views
Find functions signatures in Ida?
I didn't understand the subject of find function in Ida via signature.
If I understand well that way helps to recognize libraries functions in static binary(in dynamic binary I can see the functions ...
0
votes
1answer
39 views
PE file export functions of packed file
I am new to reverse engineering and I am learning about packed files.
I saw that most of the time I can recognize a packed file with a little number of import functions in PE file and not many strings ...
0
votes
0answers
26 views
How does BAP- BinaryAnalysisPlatform helps for reverse engineering
I saw the BAP- BinaryAnalysisPlatform as a helpful tool for reverse engineering.
Can you please explain me how does this BAP, helps for reverse engineering (I already use Ida pro)
0
votes
0answers
12 views
Open all object files in Ida
I have archive file , like libc.a .
When I tried to open it with ida, ida ask to choose one object file that contain in archive file.
Is there any way to open all the object files in one Ida project?...
0
votes
1answer
62 views
Find all syscall in statically Arm Binary
What is the easy and fast way to find all syscall in statically Arm binary ?
Is there any Ida plugin that do that?
0
votes
0answers
46 views
Python based static c analysis tools
I want to analyze some open-source C code, and I'm looking for a static analysis python library for C, preferably open-source. Any ideas/suggestions, based on your experience?
0
votes
1answer
74 views
Get function return value
any idea for more ways to get return value?
(no hooks, no hw/memory breakpoints, no call functions)
thx :)
tried to find dword maybe that hold the function return, didn't found.
I'm trying to create ...
1
vote
0answers
14 views
Locating Exit/Abort Functions from Static Analysis
Similar to this question, I'm interested in locating exit and abort style functions in a firmware - any function call that in fact terminates the execution, by statically analyzing the firmware.
My ...
0
votes
1answer
71 views
Can relative offsets in instructions like call and jmp change after recompiling the same code, or running it in another computer?
So let's say we want to use some instructions as signature for a malware, and it includes some call instructions or jmp instructions. Now, as far as I have seen, they always contain relative offsets ...
1
vote
1answer
101 views
How to extract static API sequences of a PE file?
How does one extract the static API sequences of a PE file? I don't mean the imports listed in the imports segment.
I am currently using different RE tools like Ghidra, IDA Pro, and Binary Ninja. ...
1
vote
0answers
30 views
IDA Pro SP tracking
I am reversing a BIOS and its code extensively uses SP register for 16-bit return addresses (and also things like "bswap ESP" to obtain a "two-level-deep" stack, and rarely "mov mm7, esp" to obtain a "...
0
votes
1answer
193 views
Obfuscated VBE malware script analysis
Some actions of this script are clear e.g. the section that adds firewall rules, others not so much
On Error Resume Next
F27
F10
A0
DBCF
Sub F27()
Dim E13C563AFCB34, C0009B48F34B, C8, ...
0
votes
1answer
80 views
Detecting libc function with IDA
I have binary than running on Arm , static and striped.
I don't know which compiler compiled this binary.
How can I identify function like fread sleep printf ioctl
1
vote
1answer
74 views
Memory map in AVR Harvard architecture
In this video https://youtu.be/D0VKuZuuvW8?t=259 .
You can see that flash address is beteen 0x0 to 0x3fff. and Data memory ( Io register and SRAM ) is between 0x0 to 0x8ff .
So in the video he ask ...
0
votes
1answer
63 views
IDA Change ram and rom without reopen IDA
when I open binary and write ram and rom , I don't know how to change it (and re parse all the binary) without close and open again the binary.
Is there any smart way ?
1
vote
2answers
609 views
Why Windows Defender is not able to get rid of this trojan?
Every time I start my PC, Windows Defender shows a notification saying that the virus Trojan:Win32/Ceprolad.A was deleted, which means indeed that it wasn't, as most antivirus I've tried these days (...
1
vote
0answers
36 views
static core dump analysis
I got a coredump from an unknow binary. I want to retrieve as many information as possible (memory, register, contexte..)
Most of the answers available on the web speak about coredump analysis using ...
5
votes
0answers
125 views
Radare2 8051 code bank switching
Some of 8051 chips use bank switching to extend accessible code memory.
Good example is Silabs C8051F12x. Another example is here.
Code area in range 0x0000..0x7ffff is common always accessible code ...
1
vote
1answer
91 views
Finding a mathematical calculation which uses Pi within binary
Given a large (~14MB) binary compiled for a X86 64-bit system, what would be the basic steps to go through in order to find the usage of Pi (π) for calculation of a certain parameter (flag)?
I'm ...
2
votes
1answer
127 views
APK static analysis tools - frameworks used, vulnerability checks, etc? [closed]
I'm familiar with tools for unpacking/decompiling APKs - JADX, apktool, dex2jar, JD-GUI, and the like. I'm curious if there are tools which automate other useful tasks when reversing an APK, such as:
...
1
vote
1answer
161 views
How to restore IAT?
I have the start address and the end address of the IAT
now im trying to restore the table/folder of it.
the start address is: E7C000
thx for helping
0
votes
0answers
44 views
Add MessageBox statically modify
So i'm doing this challenge which i have an exe file and a dll all i have to do is
modify it statically to pop a MessageBox.
The exe file is loading the dll which load the MessageBox, with ollydbg ...
-1
votes
1answer
811 views
How do I find the address of a data location at runtime?
I'm using ghidra and cheat engine to reverse engineer a game's function. In ghidra's decompiler this function references two locations known as _DAT_XXX. I know the addresses of these locations in the ...
1
vote
0answers
33 views
Parse / statically analyzing .NET binaries using python
Which libraries do you use to parse and statically analyze .NET binaries?
Is there a python module, or do I have to use a .NET library such as dnlib? Does it make sense to write a python wrapper for ...
-1
votes
1answer
106 views
How to find who use these strings?
When i see function like this, im getting confused, because all the strings i need in this function, but how can i find which functions which this strings?
how can i know the address of the function ...
1
vote
2answers
162 views
Trouble when reverse engineering a industrial robot software in order to get some values
For the bit of background, I'm a robotic engineer.
Robotics manufactures hide some parameters of their robots in order to avoid their competition. Now, I need these data to compute the dynamics model ...
1
vote
0answers
111 views
Reconstructing struct/union-based IPC protocol wire format
I'm embarking on my first reverse-engineering adventure. I think I've picked a rather dense piece of steak to start out with.
I have three C programs which communicate together using an unknown IPC ...
1
vote
1answer
216 views
Identify function in cpp static binary
When I open cpp static binary, how can identify known functions like fopen/ioctl/printf? They have been compiled statically into the binary.
I dont know the compiler of this binary .
1
vote
1answer
235 views
pyelftools relocation section symbols
I have been trying to get into reverse engineering as of late and after playing with Radare2 I realized I was playing with a lot of things without really understanding what I was doing. In an effort ...
0
votes
1answer
150 views
Automatically detecting and carving images from .doc, .docx and spreadsheets
I'm looking for a tool that can extract detect and extract any image format from word documents in both .doc and .docx formats for an automatic document classification use case. It is nice to just ...
1
vote
1answer
444 views
How to find the starting address of main function when the binary is stripped and _start doesn't push the absolute address value of main?
So let's say the ELF binary is stripped - meaning no symbol table - and the _start function doesn't push the address of main before calling __libc_start_main.
This happened in a binary when compiled ...
0
votes
1answer
138 views
How can I know what the executable is missing to run?
I have extracted a presence of MZ file from memory which happen to be available in virustotal ( might be a malicious executable). However, I could not run the program. It seems to have some missing ...
0
votes
1answer
148 views
me_cleaner and fwupd, or manipulating UEFI .cab files
I'd like to extract a plain dump of the UEFI firmware of my laptop (1:1 copy of the flash content, often called .bin or .rom files) from the .cap file, so that I can modify it slightly with me_cleaner....
6
votes
1answer
2k views
Can I define custom enum-type to be used in Ghidra as a data type?
I'm trying to learn Ghidra. Say, if it generated the following code for loading functions from an array of function names from gpfnCommCtrlAPI:
I was able to retype gpfnCommCtrlAPI into char*[14] ...
0
votes
1answer
64 views
what does BYTES_REVERSED_HI and BYTES_REVERSED_LO in an PE signify
How can these pe attributes be used to identify malware.
I was going though a paper link at page 10 he mentioned.
"BYTES_REVERSED_HI and BYTES_REVERSED_LO both make ideal candidates as a primary ...
0
votes
0answers
507 views
Finding function call (with arguments) in ELF file
I have two kinds of ELF files, built from C++.
.so files:
ELF 64-bit LSB shared object, x86-64, version 1 (GNU/Linux), dynamically linked, BuildID[sha1]=5e751e769912aef28bc63b888e5e4904b867a180, ...
1
vote
0answers
140 views
Saving IDA Graph to PDF format?
I want to save flow/call graph of IDA into a pdf format so that I could view it in my android. How can I do that?
I know IDA can generate a flow chart (gdl file) and call chart (gdl file). But my ...
