Questions tagged [static-analysis]
Static analysis is the analysis code without actually executing it. This is in contrast to [tag:dynamic-analysis] which executes the code.
0
votes
1answer
71 views
Radare2 Disassembler How Do You Organize Visual Panels (V!)?
I would like to use Radare2 to learn about how C is assembled into assembly but I am having trouble with the layout. I think the V! mode would be very handy as you can watch the registers update as ...
1
vote
1answer
56 views
Debugger Win32 Local vs WinDbg in Ida vs Ollydbg
When I do dynamic analyze of exe file I have few option , and I want to know what are the advantages and disadvantages.
I know that Ida designated for static analyze , but there are some debugger in ...
0
votes
1answer
45 views
Start Symbolic Analysis at a Given Address with Angr
Lets suppose I have a very big binary and I want to reverse just a part of this binary.
Is there a way to tell angr to start symbolic analysis at a given address ?
1
vote
1answer
54 views
IDA - large jump table, missing cases in analysis
I have come across the following jump table with a large amount of cases (160+). There seems to be cases missing from IDAs analysis though. For example it skips from cases 22 -> 38 -> 91, and I can ...
2
votes
1answer
50 views
Why does -A (aaa) analysis show much more information, when using the -d (debug) CLI option in Radare2?
Why does -A (aaa) analysis show much more information, when using the -d (debug) CLI option in Radare2?
I'm using the newest version of Radare2 to analyze the Windows application.
As can be seen ...
1
vote
1answer
147 views
How to reverse engineer a Black Box?
I am trying to reverse engineer / research a black box system, this is, a system for which there is no public information at all. Let's say the system is a modern handheld console.
I have already ...
0
votes
1answer
52 views
Reverse engineering Infostealer.Dyre
I'm a newbie to malware analysis and reverse engineering in general. I got hold of a Dyre malware sample from theZoo on GitHub and I've been trying to analyze it.
I've put up my analysis report here. ...
1
vote
1answer
119 views
Radare's `aaaa` and -AA what does it do, exactly?
When I run aaa, Radare tells me,
[x] Use -AA or aaaa to perform additional experimental analysis.
But what does aaaa do? It's not documented under aa? nor aaa? nor
[0x000028e0]> aaa?
Usage: See ...
1
vote
1answer
54 views
Learning fine grained analysis in Radare with `a`?
The Radare community generally seems to look down upon simply running AAA or AAAA claiming that you need to instead learn the fine grained analysis and what they do. However, there seems to be no ...
1
vote
1answer
163 views
Is this a good way to get past anti-debugging measures?
This program I am analyzing is full of anti-debugging. It won't even run if most debuggers are loaded before I start the app.
I tried using IDA to static analyze it, but it was written in a OOP ...
0
votes
0answers
53 views
Does Radare offer the ability to invoke the linker and disassemble a function (import or reloc)?
Sometimes I'm doing static analysis outside of the debugger, and I want to see what a function that a symbol points to will do after the linker does runtime relocation. All I see in the disassembly is ...
3
votes
1answer
326 views
Emulating Routers and other Embedded Devices with QEMU
I'm thinking about reverse engineering a few router models and trying to get them running with QEMU. In particular I'm trying to get the web server running. The current issue I'm thinking might be a ...
1
vote
1answer
109 views
Reverse Engineering Flat Data File
I'm writing a piece of software that will take positional data from a piece of software called Pyware and put it into a GUI so I can visualize the coordinates and assign each coordinate a color.
...
1
vote
1answer
61 views
Windbg's “dt” equivalent in IDA?
I wanted to ask whether there is a simple way to see an object's structure (like windbg's "dt" command equivalent)?
Assuming of course I have the pdb file.
Thank you :)
3
votes
2answers
171 views
Hybrid binary analysis tool
I have an idea to merge static and dynamic analysis into a visualization through the IDA python scripting interface. The concept involves automatically setting breakpoints at each function or basic ...
3
votes
2answers
50 views
Finding a particular call to an offset within a vtable using pattern matching
Let's say I have a very simple pattern I'm looking for. E.g. the following regex,
mov.*(eax|edx|ecx|esi|edi), \[(eax|edx|ecx|esi|edi)\+30h\]
Now, I'm also looking for references to this in which the ...
7
votes
1answer
154 views
How to detect internal and shared libraries used in an executable file?
Problem: We want to be able to tell with some certainty that specific versions of internal libraries are being used by a program. For example, if a software uses old, deprecated libraries internally. ...
3
votes
1answer
108 views
Basic hello world stack manipulation troubles
I'm a beginner in reverse engineering, and as a beginner I started to read "Reverse Engineering for beginers".
Here is the hello world program from the book (taken from chapter 3, page 12) :
Now ...
-1
votes
1answer
55 views
Understanding what is represented by function pointers to a block of hex
I'm working on a disassembly project for my class where I'm trying to bypass a license check, but when I throw the executable into Binary Ninja this is what I see:
And when I look at those pointers, ...
2
votes
2answers
70 views
find equation based on multiple sets of 2 variables and results
I'm currently trying to reverse engineer a few equations used in a game, and have collected what seems to be all the relevant data.
In the example below, result speed is definitely based solely on ...
5
votes
0answers
161 views
How to find if a given library function is used in a binary?
Assuming that library X is statically linked, is there a way to know with an acceptable grade of confidence if a function from it was used in the binary?
I am currently using this approach:
Convert ...
0
votes
1answer
291 views
Parsing .rodata (ELF)
IDA pro is able to display the data contained in the read only data section of ELF files, but the section is defined as type SHT_PROGBITS.
To my knowledge, we cannot parse sections of this type to ...
1
vote
1answer
37 views
IDA search results not showing up in a separate window
I'm just learning to use IDA and according to the book, when using Search function (Search>text..., for example) I should see a window with the found results, like this:
However, when the search ...
1
vote
1answer
151 views
Which RE tool is missing?
I am analyzing a malware at the moment which scans for a lot of filenames and ClassNames to recognize if it is under supervision or not.
My problem is, that all the filenames and ClassNames are ...
3
votes
1answer
360 views
No apparent entry point for stripped, PIE binary using radare2
I am running on 64-bit Windows 7 and am using radare2 to attempt both static and dynamic analysis of a binary executable. The issue is that I cannot seem to find the entry point of where the program ...
-2
votes
1answer
75 views
Malware static rules? [closed]
Is there any sites to get static rules to detect malware files?
static behavior rules for detecting malware files.
Thanks in advance.
1
vote
1answer
471 views
Elf file format finding .got and .got.plt segments
I'm writing ELF parser and simple disassembler x86. Having code like this
.text:000B5A2A call 0000B470 ;e.g. _glXSwapBuffers
...
...
got.plt:0000B470 jmp dword ptr [ebx+240h] ;jump to ....
1
vote
1answer
233 views
re-construction of c code: movsx with test instruction
I just started learning about reconstructing C code from assembler instructions.
I have the following piece of assembler code:
mov eax dword ptr [ebp+8]
add eax, dword ptr[ebp-4]
movsx ecx, byte ptr ...
0
votes
2answers
1k views
How to unpack and decrypt malware? [duplicate]
Recently I have been working on reverse engineering of binary samples and executables of known malware. Most of them have been packed or encrypted. And to reach the actual data or part of the program ...
1
vote
3answers
257 views
Decompress and Analyse VMWARE EFI64 bios
I want to analyse this UEFI bios here. When I open it in IDA it looks compressed to me. Also IDA lists the processor type as ZLOG. Shouldn't this be the multi processor setting for IDA?
Anyway, If I ...
1
vote
1answer
113 views
What are the overall features used in static analysis of malware? Is file property among the features used in static analysis of malware?
I was looking at the paper: "Improved Detection for Advanced Polymorphic Malware" by James Fraley who claimed to have used static, dynamic and file properties for increased malware detection. But is ...
0
votes
0answers
584 views
Why some ppl don't use IDA Pro dbg to do dynamic analysis?
Could someone explain to me why there is so much people stating one should use IDA for static analysis and other dbg to dynamic analysis (ollydbg, x64dbg, etc)?
I'm studying IDA for few months and I ...
2
votes
1answer
148 views
How to detect overlay data in RTF files?
How to detect overlay data in RTF files? When officemalscanner says it detected overlay data, what does that mean ? Is overlay data specific to malicious files ?
5
votes
1answer
306 views
How can I get the shared libraries' function calls using angr
I am trying to get all the library function calls that a binary performs in a preorder-DFT traversal of the CFG. I'm able to get the CFG like:
import sys, angr
import networkx as nx
proj = angr....
0
votes
1answer
4k views
Reverse engineering a golang binary file
I compiled docker by myself with some modifications. I would like to perform some static analysis to the binary. Mostly to see which parts of the code take more memory, etc. It's on linux (elf). Any ...
1
vote
1answer
118 views
What does this sequence of numbers mean?
so i'm reversing a file format of game. As far as i can understand the file i'm trying to reverse contains compressed textures. I'm already able to locate the textures and decompress them, but i'm not ...
1
vote
0answers
68 views
Where can I get a good description about windows build-in exe programs like wupdmgr.exe?
I was checking the Strings for Lab01-04.exe from Practical Malware Analysis and I found wupdmgr.exe and I face this every time I search for an exe.
Is there any "msdn" alike repository but for exe ...
1
vote
1answer
661 views
Dose PE Explorer unpack upx executables?
I was analysing Lab01-02.exe from Practical Malware Analysis book, the exe is packed with upx, since it showed UPX0, 1, 2 in the header section when analyzed with PEview, but when I open the same exe ...
8
votes
1answer
776 views
Automated Static Unpacking Binaries
I am reading the paper Automatic Static Unpacking of Malware Binaries (Kevin Coogan et al.) with the goal of trying to reproduce the given experimental results (with Hybris-C, MyDoom.q, tElock, etc), ...
0
votes
1answer
311 views
How to get better in re?
I'm a junior security researcher, and I'm interested in improving my ability in RE.
I am a programmer at Assembly and C (and python and a few more high level lang).
I learned and know how to use ...
0
votes
0answers
96 views
X86 Simple semantic similarity analysis
First of all I'm not asking for an implementation or anything, I'm more asking for advice on a course exercise I'm doing. The environment we can use is IDAPython.
So the problem is this, we're given ...
4
votes
2answers
458 views
How to get elf header via IDAPython?
In IDAPython, we can get segments with idautils.Segments().However, the result doesn't cover the whole input file, and the the first segment is ".init". My question is, how to get other things in the ...
-2
votes
1answer
91 views
Need help in understanding the code of a “Malicious” file [closed]
I'm testing a malware sample :
hxxps://www.virustotal.com/en/file/55f4cc0f9258efc270aa5e6a3b7acde29962fe64b40c2eb36ef08a7a1369a5bd/analysis/
This is a malicious executable file. When executed in ...
5
votes
2answers
451 views
Dalvik dex file version 036
I came upon a sample that indirectly contains classes.dex with the magic "Dalvik dex file version 036". If not for the version, the file seems to be normal and JEB loads it without any problem.
But ...
3
votes
0answers
271 views
Is there a static data flow analysis tool for .net assemblies?
I read here that CAT.NET and FxCop are dead. As far as I understand, the successor Roslyn requires a visual studio project and source code.
Is there a tool that reads in a compiled .NET program and ...
8
votes
1answer
214 views
Is there a way to find out which hash standard by studying the source code?
We have an embedded product, which we are carrying for several hardware iterations since more than 5 years ago. We have all the source code, most of it nicely documented. As the product is actively ...
2
votes
1answer
2k views
Are there any static binary rewriting tools？
My goal is to modify some instructions and make some instrumentation in ELF executables or libraries(For example, modifying all memory writes instructions). Since there're so many instructions, I want ...
0
votes
2answers
155 views
Identifying a very weak hash algorithm
I'm reverse-engineering a string translation file format for a particular game. It's ultimately just an ID-to-string map, where the IDs are four-byte integers. There are 1935 IDs in total; you can see ...
3
votes
1answer
85 views
How would one find test cases for a self-implemented value set analysis (VSA)?
I read a blog post about value set analysis (VSA). For VSA, see e.g. here.
The blog author writes
I’ve been trying to get to the point where the example in
Balakrishnan’s dissertation works. I ...
2
votes
2answers
260 views
Programmatically reverse-engineering a dynamic dispatch method
Background: I want to convert Qt RTTI into symbols, to more easily navigate a large executable.
If you don't know already, Qt is a C++ application framework based on a message passing system. Since C+...
