Questions tagged [static-analysis]
Static analysis is the analysis code without actually executing it. This is in contrast to [tag:dynamic-analysis] which executes the code.
0
votes
0answers
35 views
Extract file from vm memory dump
I have a vmware memory dump from a linux guest in the vmss.core format. I am dealing with an application using cryptopp and some kind of aes for encryption, and would like to extract the decrypted ...
0
votes
1answer
31 views
Reverse engineering Infostealer.Dyre
I'm a newbie to malware analysis and reverse engineering in general. I got hold of a Dyre malware sample from theZoo on GitHub and I've been trying to analyze it.
I've put up my analysis report here. ...
1
vote
1answer
56 views
Radare's `aaaa` and -AA what does it do, exactly?
When I run aaa, Radare tells me,
[x] Use -AA or aaaa to perform additional experimental analysis.
But what does aaaa do? It's not documented under aa? nor aaa? nor
[0x000028e0]> aaa?
Usage: See ...
1
vote
1answer
39 views
Learning fine grained analysis in Radare with `a`?
The Radare community generally seems to look down upon simply running AAA or AAAA claiming that you need to instead learn the fine grained analysis and what they do. However, there seems to be no ...
0
votes
1answer
126 views
Is this a good way to get past anti-debugging measures?
This program I am analyzing is full of anti-debugging. It won't even run if most debuggers are loaded before I start the app.
I tried using IDA to static analyze it, but it was written in a OOP ...
0
votes
0answers
28 views
Does Radare offer the ability to invoke the linker and disassemble a function (import or reloc)?
Sometimes I'm doing static analysis outside of the debugger, and I want to see what a function that a symbol points to will do after the linker does runtime relocation. All I see in the disassembly is ...
3
votes
1answer
133 views
Emulating Routers and other Embedded Devices with QEMU
I'm thinking about reverse engineering a few router models and trying to get them running with QEMU. In particular I'm trying to get the web server running. The current issue I'm thinking might be a ...
1
vote
1answer
96 views
Reverse Engineering Flat Data File
I'm writing a piece of software that will take positional data from a piece of software called Pyware and put it into a GUI so I can visualize the coordinates and assign each coordinate a color.
...
1
vote
1answer
53 views
Windbg's “dt” equivalent in IDA?
I wanted to ask whether there is a simple way to see an object's structure (like windbg's "dt" command equivalent)?
Assuming of course I have the pdb file.
Thank you :)
3
votes
2answers
153 views
Hybrid binary analysis tool
I have an idea to merge static and dynamic analysis into a visualization through the IDA python scripting interface. The concept involves automatically setting breakpoints at each function or basic ...
3
votes
2answers
48 views
Finding a particular call to an offset within a vtable using pattern matching
Let's say I have a very simple pattern I'm looking for. E.g. the following regex,
mov.*(eax|edx|ecx|esi|edi), \[(eax|edx|ecx|esi|edi)\+30h\]
Now, I'm also looking for references to this in which the ...
7
votes
1answer
150 views
How to detect internal and shared libraries used in an executable file?
Problem: We want to be able to tell with some certainty that specific versions of internal libraries are being used by a program. For example, if a software uses old, deprecated libraries internally. ...
3
votes
1answer
98 views
Basic hello world stack manipulation troubles
I'm a beginner in reverse engineering, and as a beginner I started to read "Reverse Engineering for beginers".
Here is the hello world program from the book (taken from chapter 3, page 12) :
Now ...
-1
votes
1answer
43 views
Understanding what is represented by function pointers to a block of hex
I'm working on a disassembly project for my class where I'm trying to bypass a license check, but when I throw the executable into Binary Ninja this is what I see:
And when I look at those pointers, ...
2
votes
2answers
64 views
find equation based on multiple sets of 2 variables and results
I'm currently trying to reverse engineer a few equations used in a game, and have collected what seems to be all the relevant data.
In the example below, result speed is definitely based solely on ...
5
votes
0answers
154 views
How to find if a given library function is used in a binary?
Assuming that library X is statically linked, is there a way to know with an acceptable grade of confidence if a function from it was used in the binary?
I am currently using this approach:
Convert ...
0
votes
1answer
237 views
Parsing .rodata (ELF)
IDA pro is able to display the data contained in the read only data section of ELF files, but the section is defined as type SHT_PROGBITS.
To my knowledge, we cannot parse sections of this type to ...
1
vote
1answer
35 views
IDA search results not showing up in a separate window
I'm just learning to use IDA and according to the book, when using Search function (Search>text..., for example) I should see a window with the found results, like this:
However, when the search ...
1
vote
1answer
146 views
Which RE tool is missing?
I am analyzing a malware at the moment which scans for a lot of filenames and ClassNames to recognize if it is under supervision or not.
My problem is, that all the filenames and ClassNames are ...
3
votes
1answer
286 views
No apparent entry point for stripped, PIE binary using radare2
I am running on 64-bit Windows 7 and am using radare2 to attempt both static and dynamic analysis of a binary executable. The issue is that I cannot seem to find the entry point of where the program ...
-2
votes
1answer
72 views
Malware static rules? [closed]
Is there any sites to get static rules to detect malware files?
static behavior rules for detecting malware files.
Thanks in advance.
1
vote
1answer
402 views
Elf file format finding .got and .got.plt segments
I'm writing ELF parser and simple disassembler x86. Having code like this
.text:000B5A2A call 0000B470 ;e.g. _glXSwapBuffers
...
...
got.plt:0000B470 jmp dword ptr [ebx+240h] ;jump to ....
1
vote
1answer
191 views
re-construction of c code: movsx with test instruction
I just started learning about reconstructing C code from assembler instructions.
I have the following piece of assembler code:
mov eax dword ptr [ebp+8]
add eax, dword ptr[ebp-4]
movsx ecx, byte ptr ...
0
votes
2answers
765 views
How to unpack and decrypt malware? [duplicate]
Recently I have been working on reverse engineering of binary samples and executables of known malware. Most of them have been packed or encrypted. And to reach the actual data or part of the program ...
0
votes
0answers
30 views
Weird exception handling stub (or custom code) [duplicate]
I am having trouble reversing the following code segment:
1 push FFFFFFFF
2 push 0a1fbaf99e495555ee71f4abe4aa5a6983bd4e2a.4A7A28
3 mov eax,dword ptr fs:[0]
4 push eax
5 push ecx
...
1
vote
3answers
224 views
Decompress and Analyse VMWARE EFI64 bios
I want to analyse this UEFI bios here. When I open it in IDA it looks compressed to me. Also IDA lists the processor type as ZLOG. Shouldn't this be the multi processor setting for IDA?
Anyway, If I ...
1
vote
1answer
109 views
What are the overall features used in static analysis of malware? Is file property among the features used in static analysis of malware?
I was looking at the paper: "Improved Detection for Advanced Polymorphic Malware" by James Fraley who claimed to have used static, dynamic and file properties for increased malware detection. But is ...
0
votes
0answers
523 views
Why some ppl don't use IDA Pro dbg to do dynamic analysis?
Could someone explain to me why there is so much people stating one should use IDA for static analysis and other dbg to dynamic analysis (ollydbg, x64dbg, etc)?
I'm studying IDA for few months and I ...
2
votes
1answer
140 views
How to detect overlay data in RTF files?
How to detect overlay data in RTF files? When officemalscanner says it detected overlay data, what does that mean ? Is overlay data specific to malicious files ?
5
votes
1answer
270 views
How can I get the shared libraries' function calls using angr
I am trying to get all the library function calls that a binary performs in a preorder-DFT traversal of the CFG. I'm able to get the CFG like:
import sys, angr
import networkx as nx
proj = angr....
0
votes
1answer
4k views
Reverse engineering a golang binary file
I compiled docker by myself with some modifications. I would like to perform some static analysis to the binary. Mostly to see which parts of the code take more memory, etc. It's on linux (elf). Any ...
1
vote
1answer
118 views
What does this sequence of numbers mean?
so i'm reversing a file format of game. As far as i can understand the file i'm trying to reverse contains compressed textures. I'm already able to locate the textures and decompress them, but i'm not ...
0
votes
0answers
65 views
How do you find the value of a Unix time function?
My question relates to a series of lines of code.
I am trying to find the value of eax. I know that the _time function returns the amount of seconds from the epoch time, but I have no idea how to ...
1
vote
0answers
68 views
Where can I get a good description about windows build-in exe programs like wupdmgr.exe?
I was checking the Strings for Lab01-04.exe from Practical Malware Analysis and I found wupdmgr.exe and I face this every time I search for an exe.
Is there any "msdn" alike repository but for exe ...
1
vote
1answer
595 views
Dose PE Explorer unpack upx executables?
I was analysing Lab01-02.exe from Practical Malware Analysis book, the exe is packed with upx, since it showed UPX0, 1, 2 in the header section when analyzed with PEview, but when I open the same exe ...
8
votes
1answer
737 views
Automated Static Unpacking Binaries
I am reading the paper Automatic Static Unpacking of Malware Binaries (Kevin Coogan et al.) with the goal of trying to reproduce the given experimental results (with Hybris-C, MyDoom.q, tElock, etc), ...
0
votes
1answer
267 views
How to get better in re?
I'm a junior security researcher, and I'm interested in improving my ability in RE.
I am a programmer at Assembly and C (and python and a few more high level lang).
I learned and know how to use ...
0
votes
0answers
95 views
X86 Simple semantic similarity analysis
First of all I'm not asking for an implementation or anything, I'm more asking for advice on a course exercise I'm doing. The environment we can use is IDAPython.
So the problem is this, we're given ...
4
votes
2answers
427 views
How to get elf header via IDAPython?
In IDAPython, we can get segments with idautils.Segments().However, the result doesn't cover the whole input file, and the the first segment is ".init". My question is, how to get other things in the ...
-2
votes
1answer
90 views
Need help in understanding the code of a “Malicious” file [closed]
I'm testing a malware sample :
hxxps://www.virustotal.com/en/file/55f4cc0f9258efc270aa5e6a3b7acde29962fe64b40c2eb36ef08a7a1369a5bd/analysis/
This is a malicious executable file. When executed in ...
5
votes
2answers
420 views
Dalvik dex file version 036
I came upon a sample that indirectly contains classes.dex with the magic "Dalvik dex file version 036". If not for the version, the file seems to be normal and JEB loads it without any problem.
But ...
3
votes
0answers
256 views
Is there a static data flow analysis tool for .net assemblies?
I read here that CAT.NET and FxCop are dead. As far as I understand, the successor Roslyn requires a visual studio project and source code.
Is there a tool that reads in a compiled .NET program and ...
8
votes
1answer
209 views
Is there a way to find out which hash standard by studying the source code?
We have an embedded product, which we are carrying for several hardware iterations since more than 5 years ago. We have all the source code, most of it nicely documented. As the product is actively ...
1
vote
1answer
2k views
Are there any static binary rewriting tools？
My goal is to modify some instructions and make some instrumentation in ELF executables or libraries(For example, modifying all memory writes instructions). Since there're so many instructions, I want ...
0
votes
0answers
477 views
Getting the address of variables in IDA
I have done most of my reverse engineering/decompiling/etc in Cheat Engine. However, the particular program I am trying to analyze shuts down when I search its memory for values. Thus I can only ...
0
votes
2answers
150 views
Identifying a very weak hash algorithm
I'm reverse-engineering a string translation file format for a particular game. It's ultimately just an ID-to-string map, where the IDs are four-byte integers. There are 1935 IDs in total; you can see ...
3
votes
1answer
84 views
How would one find test cases for a self-implemented value set analysis (VSA)?
I read a blog post about value set analysis (VSA). For VSA, see e.g. here.
The blog author writes
I’ve been trying to get to the point where the example in
Balakrishnan’s dissertation works. I ...
2
votes
2answers
246 views
Programmatically reverse-engineering a dynamic dispatch method
Background: I want to convert Qt RTTI into symbols, to more easily navigate a large executable.
If you don't know already, Qt is a C++ application framework based on a message passing system. Since C+...
1
vote
2answers
134 views
Automated Branch Input Generation
Theoretically it should be possible for a binary analysis tool such as IDA to generate an input that will trigger a specific branch patch. So for example an executable that takes in a command line ...
0
votes
1answer
103 views
Get driver binary
I am running an application that just after starting, it creates a service (process hacker tool notifies me that driver_app.sys has been created). Indeed, it says that the location of driver_app.sys ...
