Skip to main content

Questions tagged [static-analysis]

Static analysis is the analysis code without actually executing it. This is in contrast to dynamic analysis which executes the code.

Filter by
Sorted by
Tagged with
0 votes
0 answers
16 views

Scanning a repository for requests for user input

Is there any tool I could use to scan a repository to determine where user input is requested, or where a mutable file is imported?
shintuku's user avatar
  • 101
3 votes
1 answer
116 views

Ghidra is missing known code sections found in Binary Ninja. What settings to change in analysis?

I am studying binary lifting and the impacts of intermediate language representations. I have a binary that is an x86 PE file with a stripped header. I have many of these files so I need a more sample ...
Teijen's user avatar
  • 31
1 vote
0 answers
52 views

Argument section recovery for binaries

I am developing a static analysis automation tool to help me on CTFs. It would be nice for me to discover from where a certain argument of certain functions is coming from (does it come from a ...
superuser's user avatar
1 vote
0 answers
163 views

Analyse a statically linked binary and extract syscall from it using angr

How to extract all syscalls from analysing a statically linked binary. I have a script written using angr(Latest - v9.2.78) but when I start my script I get few syscalls and the analysis is like hung ...
0x4E4F4F42's user avatar
1 vote
0 answers
45 views

Retrieve functionality to button - game patching

I'm patching an old game, and I want the retrieve the toggle fullscreen functionality it's supposed to have. In the menu, in the display tab, there is a disabled option of fullscreen mode that you can ...
Yair Derry's user avatar
3 votes
1 answer
262 views

How can you tell where an assembly function ends?

Finding the start of a function is sometimes obvious - for example if some part of the code has a call foo then foo must be a function. But what about finding the end of a function? I realize tools ...
Alex Shroyer's user avatar
5 votes
1 answer
527 views

Disassembling a DOS game with dynamic code/overlays in IDA Pro

I'm working on a disassembly of an old DOS game. (Real old: 16-bit, real mode.) The bulk of the game is in a large resource file of mixed binary and data; the executable basically just loads a chunk ...
Peter Malamud Smith's user avatar
1 vote
1 answer
145 views

Unable to understand x86 instruction(s)

Recently I have been given a set of assembly instructions which I must learn to understand. I know an extremely basic level of x86 assembly but I'm starting to come across more nuances that are very ...
guest1's user avatar
  • 13
2 votes
0 answers
120 views

Ghidra python - retrieve the name of the called method

I am using Ghidra to build the function call graph of a method in java and therefore I am analyzing the bytecode of java and when I read an "invoke" instruction I have to go back to the name ...
alelib's user avatar
  • 21
3 votes
0 answers
97 views

Is there a Capturebat alternative on windows 10 for file capture?

I've been looking for a capturebat alternative that will function on Windows 10 and 64 bit. I'm not interested in capturbat's network capabilities; rather, I'm interested in its capacity to capture ...
dakar111's user avatar
2 votes
0 answers
47 views

How to get the APIs present in a particular block in a CFG using Angr?

I'm doing binary analysis based on Control Flow Graph (CFG). As I suppose to get the APIs from every block in the CFG. I'm finding it very difficult to do so using Angr as I don't have enough grip on ...
okokok hack's user avatar
0 votes
1 answer
77 views

Trying to understand this interrupted (?) function prologue

Note: The uninterrupted disassembly is at the bottom Hey, I'm looking at the the assembly and I'm trying to reverse engineer the function Here, it seems like we are saving the previous rbp. Though, it ...
Happy Jerry's user avatar
1 vote
0 answers
110 views

IDA Pro maps wrong variable for offset

I hope there is a proper way to fix my issue. Here's memory layout: .data:004F3D10 char * * gTownObjNames dd offset aMage ; DATA XREF: townManager::SetupTown(void)+245↑r .data:004F3D10 ...
mastermind's user avatar
3 votes
1 answer
2k views

How do I reverse an exe packed with an unknown packer?

I got an assignment to analize an exe file with 97% entropy. It's obviously packed but I got no results from Protection Id or PEid about which packer it used... How can I unpack it if it's possible? ...
beytrod's user avatar
  • 33
2 votes
1 answer
559 views

Nice documentation of the binary analysis tool "angr", to analyse system calls in statically linked binary and hence possibly draw a system call graph

I am a new master's student in CS. I am into the computer systems domain. I was just thinking of analyzing a statically linked binary to get a sort of database of system calls made in the binary and ...
Abhishek Ghosh's user avatar
1 vote
0 answers
113 views

How to get the call stack of WinAPI functions?

Yesterday, I noticed an answer to a question about the purpose of a certain undocumented function, which is a call stack (including the DLL library) for this function, This got me interested in the ...
IVs's user avatar
  • 137
2 votes
0 answers
256 views

How this data can be referenced in Ghidra?

I reverse engineered libil2cpp.so using ghidra. I found these lines of code in a function in the decompiler view: UnityEngine.PlayerPrefs$$GetInt(*(undefined4 *)(*(int *)(Class$ItemPref + 0x5c) + 8),5,...
hanan's user avatar
  • 309
3 votes
1 answer
463 views

Automatically name class methods in IDA

Let's say I have: mov ecx, [g_pMyClassObj] ; type CMyClass call sub_B00BA ; a thiscall function Is there a feature/plugin/script to automatically rename all subroutine occurrences to: mov ecx, [...
Maxim van Dijk's user avatar
1 vote
1 answer
307 views

Static Code Analysis of a C166 function

I am trying to understand a piece of code, working on a C166 MCU. IDA correctly loads and displays the disassembly. Below is the code snippet I am trying to analyze. I don't understand the following ...
C0DER's user avatar
  • 61
0 votes
1 answer
125 views

How to detect incorrectly named DLL?

I am trying a simple lab on malware analysis and we were given both an .exe and .dll file. However, I am told that the DLL will need to be renamed to something for it to work. How do I go about ...
Iva l's user avatar
  • 1
1 vote
2 answers
204 views

Identifying rating algorithm

I'm trying to identify the rating algorithm used to calculate the displayed average of a 1 star to 5 stars rating system. To analyze the data I collated the first and last 1000 ranks and added the ...
madlen's user avatar
  • 11
2 votes
1 answer
358 views

Split variable in Ida Pesudo Code

Sometime the meaning of variable has been changed on the function. For example from Ida pseudo code: a = price .... a= tax.... In the beginning of function a was price and after that a is tax. How ...
yfr24493AzzrggAcom's user avatar
3 votes
1 answer
490 views

What is "nullsub_XXX" in vtable in IDA

When I looking in a vtable structure in IDA pro, I know that ___cxa_pure_virtual means that the function is virtual. But what does nullsub_XXX mean in a vtable structure?
vtable's user avatar
  • 183
0 votes
2 answers
100 views

Not Understanding the FU540 Boot Process

I'm reading the manual for the SiFive FU540-C000 trying to understand the boot process, and I'm not making sense of the initial steps after power on. I'm using MSEL = 1111 based on the recommendation ...
Jonathon Anderson's user avatar
1 vote
0 answers
357 views

Pascal string representation in Hex-Rays Decompiler of IDA Pro

I'm trying to prettify a representation of Pascal-string "Could not access file "" in Hex-Rays decompiler's output. As you can see below, now its type is char[25] due to inclusion of ...
AquaRegia's user avatar
2 votes
1 answer
488 views

Ida Pro doesn't recognize known function

I open statically Arm binary with Ida Pro. While I reversing I find out some function like strstr and memcpy and etc. That Ida doesn't understand that those function are strstr and memcpy(for example) ...
yfr24493AzzrggAcom's user avatar
0 votes
1 answer
243 views

How do I interpret this double offset?

While looking at that old game I've found a class CStr that is used in an unusual (to me) manner. Most of the times a member of CStr is used, it's done as follows. In both cases, this is a CStr *. ...
mindoverflow's user avatar
0 votes
1 answer
486 views

What does this function do?

I'm trying to understand what client sends to server. I already did most of the work, but one function left. I can't understand what to do with this function and what it does. I've tried to change ...
Sergey's user avatar
  • 1
0 votes
2 answers
365 views

Format of data in the .code/.text section

I'm attempting to dissect/disassemble a windows PE file under Linux using objdump. On surface analysis, the .code section was disassembled to : tmp.exe: file format pei-i386 Disassembly of ...
ewokx's user avatar
  • 135
1 vote
0 answers
661 views

IDA script: How to properly undefine a byte and then redefine code

I'm trying to correct the following instructions in IDA using a script: jnb short near ptr loc_1C61B1+3 It order to do this I'm running a snippet like this in a script: ida_bytes.del_value(...
user3238415's user avatar
3 votes
1 answer
186 views

Determine if the function has try/catch statement via the static analysis

I need to determine if the function has exception handler via static analysis. Initially I thought that if there's SEH handler prolog in the function, then the function should have try /catch. I.e. I ...
Anton Kukoba's user avatar
  • 1,850
0 votes
0 answers
45 views

Can you strip a mips64 object file?

-strip doesn’t know what this file is but read elf and objdump recognize it read elf gives entry and all the headers. I’m trying to find main() or the start function. Can I strip the file? Do I need ...
Peter Robertson's user avatar
2 votes
1 answer
535 views

Help regarding XOR game decryption algorithm

I'm currently trying to reverse engineer the decryption algorithm for an old online game, using a chat message packet, as it contains text which is easily recognizable. I used a packet sniffer to get ...
HealYouDown's user avatar
0 votes
1 answer
633 views

Why might nm find a few undefined symbols that I can't see with xxd?

I'm cross-comparing a few approaches to testing for binaries that import a symbol and I noticed a YARA rule not finding one in sudo that nm + grep could find. I looked at it in xxd to figure out why, ...
abathur's user avatar
  • 103
1 vote
1 answer
227 views

Arrays assembly

I'm reversing my C array's programs where I'm storing numbers in arrays like this... int marks[5]; marks[0] = 1; marks[1] = 3; marks[2] = 2; marks[3] = 7; marks[4] = 9; so the compiler showing me the ...
Ramesses II's user avatar
2 votes
2 answers
327 views

Why this ASM represents Virtual Function call?

I'm referring to this question that was asked previously: Virtual functions call asm I'm wondering how is it possible to know whether this ASM listing represents Virtual Functions calls? What's in the ...
Abdullah Mohamed's user avatar
2 votes
1 answer
510 views

Not able to understand the C-switch statement in disassembly

While I'm trying to disassemble my own C code I am stuck in a problem of not understanding how this Switch statement is implemented in assembly code. Can anyone please help to figure it out? This the ...
Ramesses II's user avatar
0 votes
1 answer
1k views

Difference between \n, \0, \x00 and data from /dev/zero when performing a buffer overflow?

I am working with a binary that involves a buffer overflow on two contiguous memory blocks allocated with malloc. The binary filles up the first buffer with whatever the user inputs and hardcodes the ...
Ronald Rivera's user avatar
0 votes
0 answers
719 views

Using GDB to find the address of a buffer in a stripped C binary

I am working with a crackmes binary called Simple Overflow. It has two buffers with sizes 0x10 and 0x8, and it uses malloc to allocate two contiguous memory blocks (see <+25> and <+39> on ...
Ronald Rivera's user avatar
0 votes
1 answer
159 views

How to simplify a function "calling itself's reference"

I encounter often a function calling itself (in the pseudo code) such as: result = (**(__int64 (__fastcall ***)(volatile signed __int32 *))lambda)(lambda); Since the disassembly is call qword ptr [...
Soleil's user avatar
  • 123
0 votes
1 answer
187 views

Is it possible to make a dynamic memory allocated .data segment to static in a file?

Sorry if this is a dumb question I'm new to assembly. Basically I want to modify a function in a .exe file to return with a different data, but my issue is that the memory location of the data segment ...
Sejt's user avatar
  • 3
3 votes
2 answers
144 views

How to figure out functionality when doing Static Code Analysis in ASM?

When doing Static code analysis on a disassembled app, I usually end up seeing many calls to registers (CALL EAX for example), which is constructed in runtime, which leaves me clueless on how to ...
bolbawe's user avatar
  • 31
1 vote
2 answers
231 views

Lifting exported function instructions in PE files

I am trying to automate analysis of instructions within exported functions for a .DLL and need to be able to lift the first few instructions for the entry point of each exported function statically ...
oso's user avatar
  • 11
1 vote
4 answers
689 views

finding sequence of opcode in binary

I have dis-assmebled binary and want to check if it contains particular sequence of opcodes(obtained from other reference binary). how to do that . i know plain byte level comparison wont work as as ...
John's user avatar
  • 11
1 vote
1 answer
361 views

How can I find a value in Tricore(TC1766) Arch?

I recently work on Tricore Processor, but I have some problems. With reading memory value. I do not know if I am right or not, but I think a part of flash memory copied to RAM and now in my algorithm ...
Unicornux's user avatar
  • 147
1 vote
0 answers
229 views

Delphi mt38 CRC (Tricore 1766 Arch)

I want to calculate CRC32 for Delphi mt38 and found the below assembly algorithm and converted it to C. It seems that this algorithm is defined for n = 256 or 1024. I want to calculate CRC32 for n = ...
bahar's user avatar
  • 11
2 votes
0 answers
41 views

How can I tell whether or not a given library method is being referenced by a consumer program statically in OOP languages?

Preface: This question is about source code reverse engineering and static analysis. Meaning, there is no built code available but I have access to the source code of the program. Imagine I'm looking ...
the_endian's user avatar
  • 1,880
2 votes
0 answers
202 views

CRC16 Reverse in C166 Arch

Before that I asked about piece of code that used in this algorithm (here). Now I have a bit problem with the rest of algorithm. So I have to describe this with detail. Sorry if i vast your time for ...
Unicornux's user avatar
  • 147
0 votes
1 answer
919 views

Static Binary in Windows

I am learning more about binary exploitation on windows. But I saw while revering a binary that you can create static binaries in windows too just like in Linux. It was really ugly. if I would be on ...
lucky thandel's user avatar
1 vote
0 answers
45 views

Strange memory allocation behaviour

I'm currently working on a modding library for a particular game, and I have come across a part of the menu system that I can't figure out the purpose of. The expression in question is this: unsigned ...
squ1dd13's user avatar

1
2 3 4 5