Questions tagged [static-analysis]

Static analysis is the analysis code without actually executing it. This is in contrast to dynamic analysis which executes the code.

Filter by
Sorted by
Tagged with
0
votes
0answers
23 views

What is the difference between a file on disk and a file on memory?

Currently, I am learning about the differences between static and dynamic analysis. I have come across this incredible question that has been bugging me: What happens to the file (in memory) when you ...
2
votes
1answer
82 views

Help regarding XOR game decryption algorithm

I'm currently trying to reverse engineer the decryption algorithm for an old online game, using a chat message packet, as it contains text which is easily recognizable. I used a packet sniffer to get ...
0
votes
0answers
72 views

the parameter of the function

i was given the following asm code: fx: push rbp mov rbp, rsp mov DWORD PTR [rbp-4], edi mov eax, DWORD PTR [rbp-4] sal eax, 3 cmp ...
0
votes
1answer
59 views

Why might nm find a few undefined symbols that I can't see with xxd?

I'm cross-comparing a few approaches to testing for binaries that import a symbol and I noticed a YARA rule not finding one in sudo that nm + grep could find. I looked at it in xxd to figure out why, ...
1
vote
1answer
128 views

Arrays assembly

I'm reversing my C array's programs where I'm storing numbers in arrays like this... int marks[5]; marks[0] = 1; marks[1] = 3; marks[2] = 2; marks[3] = 7; marks[4] = 9; so the compiler showing me the ...
2
votes
2answers
116 views

Why this ASM represents Virtual Function call?

I'm referring to this question that was asked previously: Virtual functions call asm I'm wondering how is it possible to know whether this ASM listing represents Virtual Functions calls? What's in the ...
2
votes
1answer
77 views

Not able to understand the C-switch statement in disassembly

While I'm trying to disassemble my own C code I am stuck in a problem of not understanding how this Switch statement is implemented in assembly code. Can anyone please help to figure it out? This the ...
0
votes
1answer
64 views

Difference between \n, \0, \x00 and data from /dev/zero when performing a buffer overflow?

I am working with a binary that involves a buffer overflow on two contiguous memory blocks allocated with malloc. The binary filles up the first buffer with whatever the user inputs and hardcodes the ...
0
votes
0answers
42 views

Using GDB to find the address of a buffer in a stripped C binary

I am working with a crackmes binary called Simple Overflow. It has two buffers with sizes 0x10 and 0x8, and it uses malloc to allocate two contiguous memory blocks (see <+25> and <+39> on ...
0
votes
1answer
54 views

How to simplify a function “calling itself's reference”

I encounter often a function calling itself (in the pseudo code) such as: result = (**(__int64 (__fastcall ***)(volatile signed __int32 *))lambda)(lambda); Since the disassembly is call qword ptr [...
0
votes
1answer
55 views

Is it possible to make a dynamic memory allocated .data segment to static in a file?

Sorry if this is a dumb question I'm new to assembly. Basically I want to modify a function in a .exe file to return with a different data, but my issue is that the memory location of the data segment ...
3
votes
2answers
72 views

How to figure out functionality when doing Static Code Analysis in ASM?

When doing Static code analysis on a disassembled app, I usually end up seeing many calls to registers (CALL EAX for example), which is constructed in runtime, which leaves me clueless on how to ...
1
vote
2answers
45 views

Lifting exported function instructions in PE files

I am trying to automate analysis of instructions within exported functions for a .DLL and need to be able to lift the first few instructions for the entry point of each exported function statically ...
1
vote
4answers
89 views

finding sequence of opcode in binary

I have dis-assmebled binary and want to check if it contains particular sequence of opcodes(obtained from other reference binary). how to do that . i know plain byte level comparison wont work as as ...
0
votes
1answer
64 views

How can I find a value in Tricore(TC1766) Arch?

I recently work on Tricore Processor, but I have some problems. With reading memory value. I do not know if I am right or not, but I think a part of flash memory copied to RAM and now in my algorithm ...
0
votes
0answers
44 views

How to use aarch64 call convention to understand an unknown function?

I’m trying to reverse engineer an aarch64 Golang binary which happens to call a symbol, i.e., function named guess_me which is an import. To stop the binary from throwing errors, I write a Hello World!...
0
votes
0answers
81 views

Delphi mt38 CRC (Tricore 1766 Arch)

I want to calculate CRC32 for Delphi mt38 and found the below assembly algorithm and converted it to C. It seems that this algorithm is defined for n = 256 or 1024. I want to calculate CRC32 for n = ...
3
votes
0answers
30 views

How can I tell whether or not a given library method is being referenced by a consumer program statically in OOP languages?

Preface: This question is about source code reverse engineering and static analysis. Meaning, there is no built code available but I have access to the source code of the program. Imagine I'm looking ...
1
vote
0answers
71 views

CRC16 Reverse in C166 Arch

Before that I asked about piece of code that used in this algorithm (here). Now I have a bit problem with the rest of algorithm. So I have to describe this with detail. Sorry if i vast your time for ...
0
votes
1answer
62 views

Static Binary in Windows

I am learning more about binary exploitation on windows. But I saw while revering a binary that you can create static binaries in windows too just like in Linux. It was really ugly. if I would be on ...
1
vote
0answers
35 views

Strange memory allocation behaviour

I'm currently working on a modding library for a particular game, and I have come across a part of the menu system that I can't figure out the purpose of. The expression in question is this: unsigned ...
0
votes
1answer
64 views

Password evaluated from the sum of ASCII letters

After analyzing the code, I have been able to understand and recreate the algorithm used to check if the password the binary takes is correct, but don't know how to solve it (or at least can't think ...
-3
votes
1answer
196 views

The C166 family code meaning

What the meaning of this code with an explanation? sub_37C2: mov r5, r4 shr r5, #14 shl r5, #1 mov r5, [r5+0FE00h] ; DPP0 bmov r4.14, r5.0 bmov r4.15, r5.1 shr r5, #2 rets ; ...
0
votes
2answers
125 views

Is manually converting/decompiling x86 source code to C/C++/etc… considered reverse engineering?

I have the source code of an old program written in 32-bit x86 assembler that I am working on manually rewriting in C. The first time someone asked me about this project I told them I was 'reverse ...
1
vote
0answers
41 views

Statically injecting translated NASM assembly into existing ELF binary

I'm trying to statically patching ELF binaries in order to incorporate code that can help provide run-time protection. In an effort to save time writing and debugging assembly, I took the following no-...
0
votes
0answers
22 views

Symbols for detecting UBSan

I am looking for the symbols that reveal if a specific binary was compiled with UBSan. Unfortunately, Checksec is not able to detect it. So, I have compiled the snippet reported in the official doc. ...
1
vote
0answers
59 views

Immediate offset LDR in presumed malloc function looks wrong in static analysis

I am attempting to disassemble a ROM image for a BCM4366C [1] after reading a blog post where researchers reversed some other Broadcom chips [2] . I have analyzed the ROM image in Ghidra and I have ...
0
votes
1answer
35 views

What is this line and how to remove it

I tried to unpack packed_dll, when the unpack stage done, i dumped unpacked_dll out and start to reverse. I pretty sure this is continuously function of that dll but this line show up. So what is this ...
-1
votes
1answer
119 views

How can I analyze this code? [closed]

I wanted to analyse the code for some functionality. in my understanding the code contains a logic handling intents with extras. I want to know how these Works! and also how can I pass extras using ...
1
vote
0answers
110 views

Removing/bypassing a BIOS whitelist

I am trying to bypass or erase the BIOS whitelist on my Thinkpad T440p. So far I've used flashrom and a soic8 clip to dump the bios to a bios.img file made another dump and compared with diff bios....
0
votes
0answers
144 views

What are the known techniques used by wrappers and obfuscators to protect against decompiling?

I am NOT looking to make my application 99% safe, nor my goal is to prevent a a determined reverse-engineer to disassemble it, but simply is to protect my source code from lambda user with little ...
0
votes
1answer
81 views

ida identifies library function as regular function

I'm trying to find libc symbols in some Windows 32-bit application. For some reason, Ida autoanalysis didn't recognized code that comes from libc as "library function", but as a "regular function". ...
1
vote
0answers
56 views

ARM chip gpio/ identification from firmware code

Device: i was able to recover bricked Chinese IOT a Sous Vide cooker. Replaced damaged capacitor. it works. it has ARM soc/mcu/processor WI-FI (broadcom) LCD touch screen + 16bit STM mcu. EEPROM ...
1
vote
1answer
52 views

methods that have zero usage in jadx?

so i've been reversing this ai assistant app to figure out what kind of forensic data it leaves on local file system. during static analysis with jadx-gui i found some interesting methods that take ...
1
vote
1answer
165 views

Dynamic analysis (Frida) reveals instance of a class that doesn't exist in the source code (dex2jar)

I have been diving into an apk's source code, doing both static analysis with Jadx (same as dex2jar) and dynamic analysis with Frida. I am trying to replicate the method that signs HTTP requests "...
0
votes
0answers
38 views

static analysis for identifying backdoors

I am doing a research in identifying backdoors in windows .exe files. Currently I found some methods to detect. 1.String search in .exe 2.find Reffrence .dll and win32 Api calls using import table ...
0
votes
0answers
36 views

Is there any tool that finds common things like strings among large number of binaries?

So this is really needed in malware analysis, for example if i have 1000 samples from a family and i want to know which strings are common among all of them, it would really help to have a tool that ...
0
votes
1answer
600 views

Find functions signatures in Ida?

I didn't understand the subject of find function in Ida via signature. If I understand well that way helps to recognize libraries functions in static binary(in dynamic binary I can see the functions ...
0
votes
1answer
64 views

PE file export functions of packed file

I am new to reverse engineering and I am learning about packed files. I saw that most of the time I can recognize a packed file with a little number of import functions in PE file and not many strings ...
0
votes
0answers
32 views

How does BAP- BinaryAnalysisPlatform helps for reverse engineering

I saw the BAP- BinaryAnalysisPlatform as a helpful tool for reverse engineering. Can you please explain me how does this BAP, helps for reverse engineering (I already use Ida pro)
1
vote
1answer
172 views

Find all syscall in statically Arm Binary

What is the easy and fast way to find all syscall in statically Arm binary ? Is there any Ida plugin that do that?
0
votes
0answers
47 views

Python based static c analysis tools

I want to analyze some open-source C code, and I'm looking for a static analysis python library for C, preferably open-source. Any ideas/suggestions, based on your experience?
0
votes
1answer
108 views

Get function return value

any idea for more ways to get return value? (no hooks, no hw/memory breakpoints, no call functions) thx :) tried to find dword maybe that hold the function return, didn't found. I'm trying to create ...
1
vote
0answers
14 views

Locating Exit/Abort Functions from Static Analysis

Similar to this question, I'm interested in locating exit and abort style functions in a firmware - any function call that in fact terminates the execution, by statically analyzing the firmware. My ...
0
votes
1answer
84 views

Can relative offsets in instructions like call and jmp change after recompiling the same code, or running it in another computer?

So let's say we want to use some instructions as signature for a malware, and it includes some call instructions or jmp instructions. Now, as far as I have seen, they always contain relative offsets ...
1
vote
1answer
165 views

How to extract static API sequences of a PE file?

How does one extract the static API sequences of a PE file? I don't mean the imports listed in the imports segment. I am currently using different RE tools like Ghidra, IDA Pro, and Binary Ninja. ...
1
vote
0answers
38 views

IDA Pro SP tracking

I am reversing a BIOS and its code extensively uses SP register for 16-bit return addresses (and also things like "bswap ESP" to obtain a "two-level-deep" stack, and rarely "mov mm7, esp" to obtain a "...
0
votes
1answer
275 views

Obfuscated VBE malware script analysis

Some actions of this script are clear e.g. the section that adds firewall rules, others not so much On Error Resume Next F27 F10 A0 DBCF Sub F27() Dim E13C563AFCB34, C0009B48F34B, C8, ...
0
votes
1answer
114 views

Detecting libc function with IDA

I have binary than running on Arm , static and striped. I don't know which compiler compiled this binary. How can I identify function like fread sleep printf ioctl
1
vote
1answer
102 views

Memory map in AVR Harvard architecture

In this video https://youtu.be/D0VKuZuuvW8?t=259 . You can see that flash address is beteen 0x0 to 0x3fff. and Data memory ( Io register and SRAM ) is between 0x0 to 0x8ff . So in the video he ask ...