Questions tagged [static-analysis]
Static analysis is the analysis code without actually executing it. This is in contrast to dynamic analysis which executes the code.
162
questions
0
votes
0answers
12 views
Open all object files in Ida
I have archive file , like libc.a .
When I tried to open it with ida, ida ask to choose one object file that contain in archive file.
Is there any way to open all the object files in one Ida project?...
0
votes
1answer
27 views
Find all syscall in statically Arm Binary
What is the easy and fast way to find all syscall in statically Arm binary ?
Is there any Ida plugin that do that?
0
votes
0answers
41 views
Python based static c analysis tools
I want to analyze some open-source C code, and I'm looking for a static analysis python library for C, preferably open-source. Any ideas/suggestions, based on your experience?
-1
votes
0answers
42 views
Not strictly reverse engineering but a problem in software maintenance
Recently I was asked to update an automation software written in Delphi (the last released Borland version, circa 2006): I have the code, the compiler and several VMWare virtual machines emulating ...
0
votes
1answer
51 views
Get function return value
any idea for more ways to get return value?
(no hooks, no hw/memory breakpoints, no call functions)
thx :)
tried to find dword maybe that hold the function return, didn't found.
I'm trying to create ...
1
vote
0answers
13 views
Locating Exit/Abort Functions from Static Analysis
Similar to this question, I'm interested in locating exit and abort style functions in a firmware - any function call that in fact terminates the execution, by statically analyzing the firmware.
My ...
0
votes
1answer
40 views
Can relative offsets in instructions like call and jmp change after recompiling the same code, or running it in another computer?
So lets say we want to use some instructions as signature for a malware, and it includes some call instructions or jmp instructions, now as far as i have seen they always contain relative offset as ...
0
votes
1answer
72 views
How to extract static API sequences of a PE file?
How does one extract the static API sequences of a PE file? I don't mean the imports listed in the imports segment.
I am currently using different RE tools like Ghidra, IDA Pro, and Binary Ninja. ...
1
vote
0answers
27 views
IDA Pro SP tracking
I am reversing a BIOS and its code extensively uses SP register for 16-bit return addresses (and also things like "bswap ESP" to obtain a "two-level-deep" stack, and rarely "mov mm7, esp" to obtain a "...
0
votes
1answer
100 views
Obfuscated VBE malware script analysis
Some actions of this script are clear e.g. the section that adds firewall rules, others not so much
On Error Resume Next
F27
F10
A0
DBCF
Sub F27()
Dim E13C563AFCB34, C0009B48F34B, C8, ...
0
votes
1answer
66 views
Detecting libc function with IDA
I have binary than running on Arm , static and striped.
I don't know which compiler compiled this binary.
How can I identify function like fread sleep printf ioctl
1
vote
1answer
50 views
Memory map in AVR Harvard architecture
In this video https://youtu.be/D0VKuZuuvW8?t=259 .
You can see that flash address is beteen 0x0 to 0x3fff. and Data memory ( Io register and SRAM ) is between 0x0 to 0x8ff .
So in the video he ask ...
0
votes
1answer
32 views
IDA Change ram and rom without reopen IDA
when I open binary and write ram and rom , I don't know how to change it (and re parse all the binary) without close and open again the binary.
Is there any smart way ?
1
vote
2answers
324 views
Why Windows Defender is not able to get rid of this trojan?
Every time I start my PC, Windows Defender shows a notification saying that the virus Trojan:Win32/Ceprolad.A was deleted, which means indeed that it wasn't, as most antivirus I've tried these days (...
1
vote
0answers
31 views
static core dump analysis
I got a coredump from an unknow binary. I want to retrieve as many information as possible (memory, register, contexte..)
Most of the answers available on the web speak about coredump analysis using ...
1
vote
0answers
52 views
Radare2 8051 code bank switching
Some of 8051 chips use bank switching to extend accessible code memory.
Good example is Silabs C8051F12x. Another example is here.
Code area in range 0x0000..0x7ffff is common always accessible code ...
1
vote
1answer
87 views
Finding a mathematical calculation which uses Pi within binary
Given a large (~14MB) binary compiled for a X86 64-bit system, what would be the basic steps to go through in order to find the usage of Pi (Ļ) for calculation of a certain parameter (flag)?
I'm ...
2
votes
1answer
105 views
APK static analysis tools - frameworks used, vulnerability checks, etc? [closed]
I'm familiar with tools for unpacking/decompiling APKs - JADX, apktool, dex2jar, JD-GUI, and the like. I'm curious if there are tools which automate other useful tasks when reversing an APK, such as:
...
0
votes
1answer
113 views
How to restore IAT?
I have the start address and the end address of the IAT
now im trying to restore the table/folder of it.
the start address is: E7C000
thx for helping
0
votes
0answers
41 views
Add MessageBox statically modify
So i'm doing this challenge which i have an exe file and a dll all i have to do is
modify it statically to pop a MessageBox.
The exe file is loading the dll which load the MessageBox, with ollydbg ...
-1
votes
1answer
307 views
How do I find the address of a data location at runtime?
I'm using ghidra and cheat engine to reverse engineer a game's function. In ghidra's decompiler this function references two locations known as _DAT_XXX. I know the addresses of these locations in the ...
1
vote
0answers
24 views
Parse / statically analyzing .NET binaries using python
Which libraries do you use to parse and statically analyze .NET binaries?
Is there a python module, or do I have to use a .NET library such as dnlib? Does it make sense to write a python wrapper for ...
0
votes
1answer
83 views
How to find who use these strings?
When i see function like this, im getting confused, because all the strings i need in this function, but how can i find which functions which this strings?
how can i know the address of the function ...
1
vote
2answers
146 views
Trouble when reverse engineering a industrial robot software in order to get some values
For the bit of background, I'm a robotic engineer.
Robotics manufactures hide some parameters of their robots in order to avoid their competition. Now, I need these data to compute the dynamics model ...
1
vote
0answers
89 views
Reconstructing struct/union-based IPC protocol wire format
I'm embarking on my first reverse-engineering adventure. I think I've picked a rather dense piece of steak to start out with.
I have three C programs which communicate together using an unknown IPC ...
1
vote
1answer
182 views
Identify function in cpp static binary
When I open cpp static binary, how can identify known functions like fopen/ioctl/printf? They have been compiled statically into the binary.
I dont know the compiler of this binary .
1
vote
1answer
157 views
pyelftools relocation section symbols
I have been trying to get into reverse engineering as of late and after playing with Radare2 I realized I was playing with a lot of things without really understanding what I was doing. In an effort ...
0
votes
1answer
109 views
Automatically detecting and carving images from .doc, .docx and spreadsheets
I'm looking for a tool that can extract detect and extract any image format from word documents in both .doc and .docx formats for an automatic document classification use case. It is nice to just ...
1
vote
1answer
288 views
How to find the starting address of main function when the binary is stripped and _start doesn't push the absolute address value of main?
So let's say the ELF binary is stripped - meaning no symbol table - and the _start function doesn't push the address of main before calling __libc_start_main.
This happened in a binary when compiled ...
0
votes
1answer
120 views
How can I know what the executable is missing to run?
I have extracted a presence of MZ file from memory which happen to be available in virustotal ( might be a malicious executable). However, I could not run the program. It seems to have some missing ...
0
votes
1answer
116 views
me_cleaner and fwupd, or manipulating UEFI .cab files
I'd like to extract a plain dump of the UEFI firmware of my laptop (1:1 copy of the flash content, often called .bin or .rom files) from the .cap file, so that I can modify it slightly with me_cleaner....
4
votes
1answer
1k views
Can I define custom enum-type to be used in Ghidra as a data type?
I'm trying to learn Ghidra. Say, if it generated the following code for loading functions from an array of function names from gpfnCommCtrlAPI:
I was able to retype gpfnCommCtrlAPI into char*[14] ...
0
votes
1answer
57 views
what does BYTES_REVERSED_HI and BYTES_REVERSED_LO in an PE signify
How can these pe attributes be used to identify malware.
I was going though a paper link at page 10 he mentioned.
"BYTES_REVERSED_HI and BYTES_REVERSED_LO both make ideal candidates as a primary ...
0
votes
0answers
372 views
Finding function call (with arguments) in ELF file
I have two kinds of ELF files, built from C++.
.so files:
ELF 64-bit LSB shared object, x86-64, version 1 (GNU/Linux), dynamically linked, BuildID[sha1]=5e751e769912aef28bc63b888e5e4904b867a180, ...
1
vote
0answers
106 views
Saving IDA Graph to PDF format?
I want to save flow/call graph of IDA into a pdf format so that I could view it in my android. How can I do that?
I know IDA can generate a flow chart (gdl file) and call chart (gdl file). But my ...
3
votes
1answer
532 views
Radare2 Disassembler How Do You Organize Visual Panels (V!)?
I would like to use Radare2 to learn about how C is assembled into assembly but I am having trouble with the layout. I think the V! mode would be very handy as you can watch the registers update as ...
1
vote
1answer
446 views
Debugger Win32 Local vs WinDbg in Ida vs Ollydbg
When I do dynamic analyze of exe file I have few option , and I want to know what are the advantages and disadvantages.
I know that Ida designated for static analyze , but there are some debugger in ...
0
votes
1answer
157 views
Start Symbolic Analysis at a Given Address with Angr
Lets suppose I have a very big binary and I want to reverse just a part of this binary.
Is there a way to tell angr to start symbolic analysis at a given address ?
1
vote
1answer
134 views
IDA - large jump table, missing cases in analysis
I have come across the following jump table with a large amount of cases (160+). There seems to be cases missing from IDAs analysis though. For example it skips from cases 22 -> 38 -> 91, and I can ...
2
votes
1answer
116 views
Why does -A (aaa) analysis show much more information, when using the -d (debug) CLI option in Radare2?
Why does -A (aaa) analysis show much more information, when using the -d (debug) CLI option in Radare2?
I'm using the newest version of Radare2 to analyze the Windows application.
As can be seen ...
2
votes
1answer
470 views
How to reverse engineer a Black Box?
I am trying to reverse engineer / research a black box system, this is, a system for which there is no public information at all. Let's say the system is a modern handheld console.
I have already ...
0
votes
1answer
77 views
Reverse engineering Infostealer.Dyre
I'm a newbie to malware analysis and reverse engineering in general. I got hold of a Dyre malware sample from theZoo on GitHub and I've been trying to analyze it.
I've put up my analysis report here. ...
1
vote
1answer
721 views
Radare's `aaaa` and -AA what does it do, exactly?
When I run aaa, Radare tells me,
[x] Use -AA or aaaa to perform additional experimental analysis.
But what does aaaa do? It's not documented under aa? nor aaa? nor
[0x000028e0]> aaa?
Usage: See ...
1
vote
1answer
207 views
Learning fine grained analysis in Radare with `a`?
The Radare community generally seems to look down upon simply running AAA or AAAA claiming that you need to instead learn the fine grained analysis and what they do. However, there seems to be no ...
3
votes
3answers
497 views
Is this a good way to get past anti-debugging measures?
This program I am analyzing is full of anti-debugging. It won't even run if most debuggers are loaded before I start the app.
I tried using IDA to static analyze it, but it was written in a OOP ...
5
votes
1answer
3k views
Emulating Routers and other Embedded Devices with QEMU
I'm thinking about reverse engineering a few router models and trying to get them running with QEMU. In particular I'm trying to get the web server running. The current issue I'm thinking might be a ...
1
vote
1answer
152 views
Reverse Engineering Flat Data File
I'm writing a piece of software that will take positional data from a piece of software called Pyware and put it into a GUI so I can visualize the coordinates and assign each coordinate a color.
...
1
vote
1answer
82 views
Windbg's “dt” equivalent in IDA?
I wanted to ask whether there is a simple way to see an object's structure (like windbg's "dt" command equivalent)?
Assuming of course I have the pdb file.
Thank you :)
3
votes
2answers
239 views
Hybrid binary analysis tool
I have an idea to merge static and dynamic analysis into a visualization through the IDA python scripting interface. The concept involves automatically setting breakpoints at each function or basic ...
3
votes
2answers
52 views
Finding a particular call to an offset within a vtable using pattern matching
Let's say I have a very simple pattern I'm looking for. E.g. the following regex,
mov.*(eax|edx|ecx|esi|edi), \[(eax|edx|ecx|esi|edi)\+30h\]
Now, I'm also looking for references to this in which the ...
