Questions tagged [static-analysis]
Static analysis is the analysis code without actually executing it. This is in contrast to dynamic analysis which executes the code.
220
questions
1
vote
0
answers
25
views
Retrieve functionality to button - game patching
I'm patching an old game, and I want the retrieve the toggle fullscreen functionality it's supposed to have.
In the menu, in the display tab, there is a disabled option of fullscreen mode that you can ...
- 21
3
votes
1
answer
124
views
How can you tell where an assembly function ends?
Finding the start of a function is sometimes obvious - for example if some part of the code has a call foo then foo must be a function.
But what about finding the end of a function? I realize tools ...
- 133
5
votes
1
answer
310
views
Disassembling a DOS game with dynamic code/overlays in IDA Pro
I'm working on a disassembly of an old DOS game. (Real old: 16-bit, real mode.) The bulk of the game is in a large resource file of mixed binary and data; the executable basically just loads a chunk ...
1
vote
1
answer
107
views
Unable to understand x86 instruction(s)
Recently I have been given a set of assembly instructions which I must learn to understand. I know an extremely basic level of x86 assembly but I'm starting to come across more nuances that are very ...
- 13
2
votes
0
answers
98
views
Ghidra python - retrieve the name of the called method
I am using Ghidra to build the function call graph of a method in java and therefore I am analyzing the bytecode of java and when I read an "invoke" instruction I have to go back to the name ...
- 21
3
votes
0
answers
66
views
Is there a Capturebat alternative on windows 10 for file capture?
I've been looking for a capturebat alternative that will function on Windows 10 and 64 bit.
I'm not interested in capturbat's network capabilities; rather, I'm interested in its capacity to capture ...
- 31
2
votes
0
answers
44
views
How to get the APIs present in a particular block in a CFG using Angr?
I'm doing binary analysis based on Control Flow Graph (CFG). As I suppose to get the APIs from every block in the CFG. I'm finding it very difficult to do so using Angr as I don't have enough grip on ...
- 39
0
votes
1
answer
61
views
Trying to understand this interrupted (?) function prologue
Note: The uninterrupted disassembly is at the bottom
Hey, I'm looking at the the assembly and I'm trying to reverse engineer the function
Here, it seems like we are saving the previous rbp. Though, it ...
1
vote
0
answers
93
views
IDA Pro maps wrong variable for offset
I hope there is a proper way to fix my issue.
Here's memory layout:
.data:004F3D10 char * * gTownObjNames dd offset aMage ; DATA XREF: townManager::SetupTown(void)+245↑r
.data:004F3D10 ...
- 33
3
votes
1
answer
821
views
How do I reverse an exe packed with an unknown packer?
I got an assignment to analize an exe file with 97% entropy. It's obviously packed but I got no results from Protection Id or PEid about which packer it used...
How can I unpack it if it's possible? ...
- 33
2
votes
1
answer
329
views
Nice documentation of the binary analysis tool "angr", to analyse system calls in statically linked binary and hence possibly draw a system call graph
I am a new master's student in CS. I am into the computer systems domain. I was just thinking of analyzing a statically linked binary to get a sort of database of system calls made in the binary and ...
- 121
1
vote
0
answers
84
views
How to get the call stack of WinAPI functions?
Yesterday, I noticed an answer to a question about the purpose of a certain undocumented function, which is a call stack (including the DLL library) for this function, This got me interested in the ...
- 115
2
votes
0
answers
161
views
How this data can be referenced in Ghidra?
I reverse engineered libil2cpp.so using ghidra. I found these lines of code in a function in the decompiler view:
UnityEngine.PlayerPrefs$$GetInt(*(undefined4 *)(*(int *)(Class$ItemPref + 0x5c) + 8),5,...
- 299
3
votes
1
answer
343
views
Automatically name class methods in IDA
Let's say I have:
mov ecx, [g_pMyClassObj] ; type CMyClass
call sub_B00BA ; a thiscall function
Is there a feature/plugin/script to automatically rename all subroutine occurrences to:
mov ecx, [...
1
vote
1
answer
204
views
Static Code Analysis of a C166 function
I am trying to understand a piece of code, working on a C166 MCU. IDA correctly loads and displays the disassembly. Below is the code snippet I am trying to analyze. I don't understand the following ...
- 51
0
votes
1
answer
87
views
How to detect incorrectly named DLL?
I am trying a simple lab on malware analysis and we were given both an .exe and .dll file.
However, I am told that the DLL will need to be renamed to something for it to work.
How do I go about ...
- 1
1
vote
2
answers
196
views
Identifying rating algorithm
I'm trying to identify the rating algorithm used to calculate the displayed average of a 1 star to 5 stars rating system. To analyze the data I collated the first and last 1000 ranks and added the ...
- 11
2
votes
1
answer
268
views
Split variable in Ida Pesudo Code
Sometime the meaning of variable has been changed on the function.
For example from Ida pseudo code:
a = price
....
a= tax....
In the beginning of function a was price and after that a is tax.
How ...
3
votes
1
answer
396
views
What is "nullsub_XXX" in vtable in IDA
When I looking in a vtable structure in IDA pro, I know that ___cxa_pure_virtual means that the function is virtual.
But what does nullsub_XXX mean in a vtable structure?
- 183
0
votes
2
answers
87
views
Not Understanding the FU540 Boot Process
I'm reading the manual for the SiFive FU540-C000 trying to understand the boot process, and I'm not making sense of the initial steps after power on.
I'm using MSEL = 1111 based on the recommendation ...
1
vote
0
answers
280
views
Pascal string representation in Hex-Rays Decompiler of IDA Pro
I'm trying to prettify a representation of Pascal-string "Could not access file "" in Hex-Rays decompiler's output. As you can see below,
now its type is char[25] due to inclusion of ...
- 11
2
votes
1
answer
346
views
Ida Pro doesn't recognize known function
I open statically Arm binary with Ida Pro.
While I reversing I find out some function like strstr and memcpy and etc. That Ida doesn't understand that those function are strstr and memcpy(for example)
...
0
votes
1
answer
187
views
How do I interpret this double offset?
While looking at that old game I've found a class CStr that is used in an unusual (to me) manner. Most of the times a member of CStr is used, it's done as follows. In both cases, this is a CStr *.
...
- 149
0
votes
1
answer
356
views
What does this function do?
I'm trying to understand what client sends to server. I already did most of the work, but one function left. I can't understand what to do with this function and what it does. I've tried to change ...
- 1
0
votes
2
answers
298
views
Format of data in the .code/.text section
I'm attempting to dissect/disassemble a windows PE file under Linux using objdump. On surface analysis, the .code section was disassembled to :
tmp.exe: file format pei-i386
Disassembly of ...
- 135
1
vote
0
answers
462
views
IDA script: How to properly undefine a byte and then redefine code
I'm trying to correct the following instructions in IDA using a script:
jnb short near ptr loc_1C61B1+3
It order to do this I'm running a snippet like this in a script:
ida_bytes.del_value(...
- 103
3
votes
1
answer
145
views
Determine if the function has try/catch statement via the static analysis
I need to determine if the function has exception handler via static analysis. Initially I thought that if there's SEH handler prolog in the function, then the function should have try /catch. I.e. I ...
- 1,830
0
votes
0
answers
41
views
Can you strip a mips64 object file?
-strip doesn’t know what this file is but read elf and objdump recognize it read elf gives entry and all the headers. I’m trying to find main() or the start function. Can I strip the file? Do I need ...
2
votes
1
answer
478
views
Help regarding XOR game decryption algorithm
I'm currently trying to reverse engineer the decryption algorithm for an old online game, using a chat message packet, as it contains text which is easily recognizable.
I used a packet sniffer to get ...
- 23
0
votes
1
answer
426
views
Why might nm find a few undefined symbols that I can't see with xxd?
I'm cross-comparing a few approaches to testing for binaries that import a symbol and I noticed a YARA rule not finding one in sudo that nm + grep could find.
I looked at it in xxd to figure out why, ...
- 103
1
vote
1
answer
214
views
Arrays assembly
I'm reversing my C array's programs where I'm storing numbers in arrays like this...
int marks[5];
marks[0] = 1;
marks[1] = 3;
marks[2] = 2;
marks[3] = 7;
marks[4] = 9;
so the compiler showing me the ...
- 323
2
votes
2
answers
239
views
Why this ASM represents Virtual Function call?
I'm referring to this question that was asked previously:
Virtual functions call asm
I'm wondering how is it possible to know whether this ASM listing represents Virtual Functions calls? What's in the ...
- 168
2
votes
1
answer
377
views
Not able to understand the C-switch statement in disassembly
While I'm trying to disassemble my own C code I am stuck in a problem of not understanding how this Switch statement is implemented in assembly code. Can anyone please help to figure it out? This the ...
- 323
0
votes
1
answer
833
views
Difference between \n, \0, \x00 and data from /dev/zero when performing a buffer overflow?
I am working with a binary that involves a buffer overflow on two contiguous memory blocks allocated with malloc. The binary filles up the first buffer with whatever the user inputs and hardcodes the ...
0
votes
0
answers
512
views
Using GDB to find the address of a buffer in a stripped C binary
I am working with a crackmes binary called Simple Overflow. It has two buffers with sizes 0x10 and 0x8, and it uses malloc to allocate two contiguous memory blocks (see <+25> and <+39> on ...
0
votes
1
answer
125
views
How to simplify a function "calling itself's reference"
I encounter often a function calling itself (in the pseudo code) such as:
result = (**(__int64 (__fastcall ***)(volatile signed __int32 *))lambda)(lambda);
Since the disassembly is call qword ptr [...
- 123
0
votes
1
answer
152
views
Is it possible to make a dynamic memory allocated .data segment to static in a file?
Sorry if this is a dumb question I'm new to assembly.
Basically I want to modify a function in a .exe file to return with a different data, but my issue is that the memory location of the data segment ...
- 3
3
votes
2
answers
128
views
How to figure out functionality when doing Static Code Analysis in ASM?
When doing Static code analysis on a disassembled app, I usually end up seeing many calls to registers (CALL EAX for example), which is constructed in runtime, which leaves me clueless on how to ...
- 31
1
vote
2
answers
209
views
Lifting exported function instructions in PE files
I am trying to automate analysis of instructions within exported functions for a .DLL and need to be able to lift the first few instructions for the entry point of each exported function statically ...
- 11
1
vote
4
answers
512
views
finding sequence of opcode in binary
I have dis-assmebled binary and want to check if it contains particular sequence of opcodes(obtained from other reference binary). how to do that . i know plain byte
level comparison wont work as as ...
- 11
1
vote
1
answer
266
views
How can I find a value in Tricore(TC1766) Arch?
I recently work on Tricore Processor, but I have some problems.
With reading memory value. I do not know if I am right or not, but I think a part of flash memory copied to RAM and now in my algorithm ...
- 147
1
vote
0
answers
203
views
Delphi mt38 CRC (Tricore 1766 Arch)
I want to calculate CRC32 for Delphi mt38 and found the below assembly algorithm and converted it to C. It seems that this algorithm is defined for n = 256 or 1024. I want to calculate CRC32 for n = ...
- 11
2
votes
0
answers
36
views
How can I tell whether or not a given library method is being referenced by a consumer program statically in OOP languages?
Preface: This question is about source code reverse engineering and static analysis. Meaning, there is no built code available but I have access to the source code of the program.
Imagine I'm looking ...
- 1,800
2
votes
0
answers
182
views
CRC16 Reverse in C166 Arch
Before that I asked about piece of code that used in this algorithm (here). Now I have a bit problem with the rest of algorithm.
So I have to describe this with detail. Sorry if i vast your time for ...
- 147
0
votes
1
answer
730
views
Static Binary in Windows
I am learning more about binary exploitation on windows. But I saw while revering a binary that you can create static binaries in windows too just like in Linux. It was really ugly. if I would be on ...
- 143
1
vote
0
answers
44
views
Strange memory allocation behaviour
I'm currently working on a modding library for a particular game, and I have come across a part of the menu system that I can't figure out the purpose of.
The expression in question is this:
unsigned ...
- 23
0
votes
1
answer
78
views
Password evaluated from the sum of ASCII letters
After analyzing the code, I have been able to understand and recreate the algorithm used to check if the password the binary takes is correct, but don't know how to solve it (or at least can't think ...
- 3
-2
votes
1
answer
475
views
The C166 family code meaning
What the meaning of this code with an explanation?
sub_37C2:
mov r5, r4
shr r5, #14
shl r5, #1
mov r5, [r5+0FE00h] ; DPP0
bmov r4.14, r5.0
bmov r4.15, r5.1
shr r5, #2
rets
; ...
- 147
0
votes
2
answers
171
views
Is manually converting/decompiling x86 source code to C/C++/etc... considered reverse engineering?
I have the source code of an old program written in 32-bit x86 assembler that I am working on manually rewriting in C.
The first time someone asked me about this project I told them I was 'reverse ...
- 133
1
vote
0
answers
108
views
Statically injecting translated NASM assembly into existing ELF binary
I'm trying to statically patching ELF binaries in order to incorporate code that can help provide run-time protection.
In an effort to save time writing and debugging assembly, I took the following no-...
- 111