Questions tagged [static-analysis]
Static analysis is the analysis code without actually executing it. This is in contrast to [tag:dynamic-analysis] which executes the code.
147
questions
1
vote
0answers
34 views
Radare2 8051 code bank switching
Some of 8051 chips use bank switching to extend accessible code memory.
Good example is Silabs C8051F12x. Another example is here.
Code area in range 0x0000..0x7ffff is common always accessible code ...
1
vote
1answer
55 views
Finding a mathematical calculation which uses Pi within binary
Given a large (~14MB) binary compiled for a X86 64-bit system, what would be the basic steps to go through in order to find the usage of Pi (π) for calculation of a certain parameter (flag)?
I'm ...
2
votes
1answer
63 views
APK static analysis tools - frameworks used, vulnerability checks, etc? [closed]
I'm familiar with tools for unpacking/decompiling APKs - JADX, apktool, dex2jar, JD-GUI, and the like. I'm curious if there are tools which automate other useful tasks when reversing an APK, such as:
...
0
votes
1answer
82 views
How to restore IAT?
I have the start address and the end address of the IAT
now im trying to restore the table/folder of it.
the start address is: E7C000
thx for helping
0
votes
0answers
35 views
Add MessageBox statically modify
So i'm doing this challenge which i have an exe file and a dll all i have to do is
modify it statically to pop a MessageBox.
The exe file is loading the dll which load the MessageBox, with ollydbg ...
-1
votes
1answer
56 views
How do I find the address of a data location at runtime?
I'm using ghidra and cheat engine to reverse engineer a game's function. In ghidra's decompiler this function references two locations known as _DAT_XXX. I know the addresses of these locations in the ...
1
vote
0answers
22 views
Parse / statically analyzing .NET binaries using python
Which libraries do you use to parse and statically analyze .NET binaries?
Is there a python module, or do I have to use a .NET library such as dnlib? Does it make sense to write a python wrapper for ...
0
votes
1answer
65 views
How to find who use these strings?
When i see function like this, im getting confused, because all the strings i need in this function, but how can i find which functions which this strings?
how can i know the address of the function ...
1
vote
2answers
122 views
Trouble when reverse engineering a industrial robot software in order to get some values
For the bit of background, I'm a robotic engineer.
Robotics manufactures hide some parameters of their robots in order to avoid their competition. Now, I need these data to compute the dynamics model ...
1
vote
0answers
46 views
Reconstructing struct/union-based IPC protocol wire format
I'm embarking on my first reverse-engineering adventure. I think I've picked a rather dense piece of steak to start out with.
I have three C programs which communicate together using an unknown IPC ...
0
votes
1answer
95 views
Identify function in cpp static binary
When I open cpp static binary, how can Identify known function like fopen/ioctl/printf ? They compile statistically into binary
I dont know the compiler of this binary .
1
vote
1answer
70 views
pyelftools relocation section symbols
I have been trying to get into reverse engineering as of late and after playing with Radare2 I realized I was playing with a lot of things without really understanding what I was doing. In an effort ...
0
votes
1answer
59 views
Automatically detecting and carving images from .doc, .docx and spreadsheets
I'm looking for a tool that can extract detect and extract any image format from word documents in both .doc and .docx formats for an automatic document classification use case. It is nice to just ...
0
votes
1answer
153 views
How to find the starting address of main function when the binary is stripped and _start doesn't push the absolute address value of main?
So let's say the ELF binary is stripped - meaning no symbol table - and the _start function doesn't push the address of main before calling __libc_start_main.
This happened in a binary when compiled ...
0
votes
1answer
106 views
How can I know what the executable is missing to run?
I have extracted a presence of MZ file from memory which happen to be available in virustotal ( might be a malicious executable). However, I could not run the program. It seems to have some missing ...
0
votes
1answer
71 views
me_cleaner and fwupd, or manipulating UEFI .cab files
I'd like to extract a plain dump of the UEFI firmware of my laptop (1:1 copy of the flash content, often called .bin or .rom files) from the .cap file, so that I can modify it slightly with me_cleaner....
4
votes
1answer
577 views
Can I define custom enum-type to be used in Ghidra as a data type?
I'm trying to learn Ghidra. Say, if it generated the following code for loading functions from an array of function names from gpfnCommCtrlAPI:
I was able to retype gpfnCommCtrlAPI into char*[14] ...
0
votes
1answer
52 views
what does BYTES_REVERSED_HI and BYTES_REVERSED_LO in an PE signify
How can these pe attributes be used to identify malware.
I was going though a paper link at page 10 he mentioned.
"BYTES_REVERSED_HI and BYTES_REVERSED_LO both make ideal candidates as a primary ...
0
votes
0answers
192 views
Finding function call (with arguments) in ELF file
I have two kinds of ELF files, built from C++.
.so files:
ELF 64-bit LSB shared object, x86-64, version 1 (GNU/Linux), dynamically linked, BuildID[sha1]=5e751e769912aef28bc63b888e5e4904b867a180, ...
1
vote
0answers
66 views
Saving IDA Graph to PDF format?
I want to save flow/call graph of IDA into a pdf format so that I could view it in my android. How can I do that?
I know IDA can generate a flow chart (gdl file) and call chart (gdl file). But my ...
3
votes
1answer
338 views
Radare2 Disassembler How Do You Organize Visual Panels (V!)?
I would like to use Radare2 to learn about how C is assembled into assembly but I am having trouble with the layout. I think the V! mode would be very handy as you can watch the registers update as ...
1
vote
1answer
310 views
Debugger Win32 Local vs WinDbg in Ida vs Ollydbg
When I do dynamic analyze of exe file I have few option , and I want to know what are the advantages and disadvantages.
I know that Ida designated for static analyze , but there are some debugger in ...
0
votes
1answer
111 views
Start Symbolic Analysis at a Given Address with Angr
Lets suppose I have a very big binary and I want to reverse just a part of this binary.
Is there a way to tell angr to start symbolic analysis at a given address ?
1
vote
1answer
103 views
IDA - large jump table, missing cases in analysis
I have come across the following jump table with a large amount of cases (160+). There seems to be cases missing from IDAs analysis though. For example it skips from cases 22 -> 38 -> 91, and I can ...
2
votes
1answer
89 views
Why does -A (aaa) analysis show much more information, when using the -d (debug) CLI option in Radare2?
Why does -A (aaa) analysis show much more information, when using the -d (debug) CLI option in Radare2?
I'm using the newest version of Radare2 to analyze the Windows application.
As can be seen ...
1
vote
1answer
343 views
How to reverse engineer a Black Box?
I am trying to reverse engineer / research a black box system, this is, a system for which there is no public information at all. Let's say the system is a modern handheld console.
I have already ...
0
votes
1answer
69 views
Reverse engineering Infostealer.Dyre
I'm a newbie to malware analysis and reverse engineering in general. I got hold of a Dyre malware sample from theZoo on GitHub and I've been trying to analyze it.
I've put up my analysis report here. ...
1
vote
1answer
522 views
Radare's `aaaa` and -AA what does it do, exactly?
When I run aaa, Radare tells me,
[x] Use -AA or aaaa to perform additional experimental analysis.
But what does aaaa do? It's not documented under aa? nor aaa? nor
[0x000028e0]> aaa?
Usage: See ...
1
vote
1answer
170 views
Learning fine grained analysis in Radare with `a`?
The Radare community generally seems to look down upon simply running AAA or AAAA claiming that you need to instead learn the fine grained analysis and what they do. However, there seems to be no ...
2
votes
1answer
362 views
Is this a good way to get past anti-debugging measures?
This program I am analyzing is full of anti-debugging. It won't even run if most debuggers are loaded before I start the app.
I tried using IDA to static analyze it, but it was written in a OOP ...
5
votes
1answer
2k views
Emulating Routers and other Embedded Devices with QEMU
I'm thinking about reverse engineering a few router models and trying to get them running with QEMU. In particular I'm trying to get the web server running. The current issue I'm thinking might be a ...
1
vote
1answer
145 views
Reverse Engineering Flat Data File
I'm writing a piece of software that will take positional data from a piece of software called Pyware and put it into a GUI so I can visualize the coordinates and assign each coordinate a color.
...
1
vote
1answer
77 views
Windbg's “dt” equivalent in IDA?
I wanted to ask whether there is a simple way to see an object's structure (like windbg's "dt" command equivalent)?
Assuming of course I have the pdb file.
Thank you :)
3
votes
2answers
201 views
Hybrid binary analysis tool
I have an idea to merge static and dynamic analysis into a visualization through the IDA python scripting interface. The concept involves automatically setting breakpoints at each function or basic ...
3
votes
2answers
52 views
Finding a particular call to an offset within a vtable using pattern matching
Let's say I have a very simple pattern I'm looking for. E.g. the following regex,
mov.*(eax|edx|ecx|esi|edi), \[(eax|edx|ecx|esi|edi)\+30h\]
Now, I'm also looking for references to this in which the ...
7
votes
1answer
181 views
How to detect internal and shared libraries used in an executable file?
Problem: We want to be able to tell with some certainty that specific versions of internal libraries are being used by a program. For example, if a software uses old, deprecated libraries internally. ...
3
votes
1answer
138 views
Basic hello world stack manipulation troubles
I'm a beginner in reverse engineering, and as a beginner I started to read "Reverse Engineering for beginers".
Here is the hello world program from the book (taken from chapter 3, page 12) :
Now ...
-1
votes
1answer
90 views
Understanding what is represented by function pointers to a block of hex
I'm working on a disassembly project for my class where I'm trying to bypass a license check, but when I throw the executable into Binary Ninja this is what I see:
And when I look at those pointers, ...
2
votes
2answers
84 views
find equation based on multiple sets of 2 variables and results
I'm currently trying to reverse engineer a few equations used in a game, and have collected what seems to be all the relevant data.
In the example below, result speed is definitely based solely on ...
6
votes
0answers
216 views
How to find if a given library function is used in a binary?
Assuming that library X is statically linked, is there a way to know with an acceptable grade of confidence if a function from it was used in the binary?
I am currently using this approach:
Convert ...
0
votes
1answer
493 views
Parsing .rodata (ELF)
IDA pro is able to display the data contained in the read only data section of ELF files, but the section is defined as type SHT_PROGBITS.
To my knowledge, we cannot parse sections of this type to ...
1
vote
1answer
45 views
IDA search results not showing up in a separate window
I'm just learning to use IDA and according to the book, when using Search function (Search>text..., for example) I should see a window with the found results, like this:
However, when the search ...
1
vote
1answer
157 views
Which RE tool is missing?
I am analyzing a malware at the moment which scans for a lot of filenames and ClassNames to recognize if it is under supervision or not.
My problem is, that all the filenames and ClassNames are ...
2
votes
1answer
594 views
No apparent entry point for stripped, PIE binary using radare2
I am running on 64-bit Windows 7 and am using radare2 to attempt both static and dynamic analysis of a binary executable. The issue is that I cannot seem to find the entry point of where the program ...
-2
votes
1answer
82 views
Malware static rules? [closed]
Is there any sites to get static rules to detect malware files?
static behavior rules for detecting malware files.
Thanks in advance.
1
vote
1answer
774 views
Elf file format finding .got and .got.plt segments
I'm writing ELF parser and simple disassembler x86. Having code like this
.text:000B5A2A call 0000B470 ;e.g. _glXSwapBuffers
...
...
got.plt:0000B470 jmp dword ptr [ebx+240h] ;jump to ....
1
vote
1answer
337 views
re-construction of c code: movsx with test instruction
I just started learning about reconstructing C code from assembler instructions.
I have the following piece of assembler code:
mov eax dword ptr [ebp+8]
add eax, dword ptr[ebp-4]
movsx ecx, byte ptr ...
0
votes
2answers
2k views
How to unpack and decrypt malware? [duplicate]
Recently I have been working on reverse engineering of binary samples and executables of known malware. Most of them have been packed or encrypted. And to reach the actual data or part of the program ...
1
vote
3answers
481 views
Decompress and Analyse VMWARE EFI64 bios
I want to analyse this UEFI bios here. When I open it in IDA it looks compressed to me. Also IDA lists the processor type as ZLOG. Shouldn't this be the multi processor setting for IDA?
Anyway, If I ...
1
vote
1answer
132 views
What are the overall features used in static analysis of malware? Is file property among the features used in static analysis of malware?
I was looking at the paper: "Improved Detection for Advanced Polymorphic Malware" by James Fraley who claimed to have used static, dynamic and file properties for increased malware detection. But is ...
