Questions tagged [static-analysis]
Static analysis is the analysis code without actually executing it. This is in contrast to dynamic analysis which executes the code.
191
questions
0
votes
0answers
9 views
How to simplify a function “calling itself's reference”
I encounter often a function calling itself (in the pseudo code) such as:
result = (**(__int64 (__fastcall ***)(volatile signed __int32 *))lambda)(lambda);
Since the disassembly is call qword ptr [...
0
votes
0answers
20 views
Is it possible to make a dynamic memory allocated .data segment to static in a file?
Sorry if this is a dumb question I'm new to assembly.
Basically I want to modify a function in a .exe file to return with a different data, but my issue is that the memory location of the data segment ...
2
votes
2answers
55 views
How to figure out functionality when doing Static Code Analysis in ASM?
When doing Static code analysis on a disassembled app, I usually end up seeing many calls to registers (CALL EAX for example), which is constructed in runtime, which leaves me clueless on how to ...
0
votes
2answers
28 views
Lifting exported function instructions in PE files
I am trying to automate analysis of instructions within exported functions for a .DLL and need to be able to lift the first few instructions for the entry point of each exported function statically ...
2
votes
4answers
81 views
finding sequence of opcode in binary
I have dis-assmebled binary and want to check if it contains particular sequence of opcodes(obtained from other reference binary). how to do that . i know plain byte
level comparison wont work as as ...
0
votes
1answer
58 views
How can I find a value in Tricore(TC1766) Arch?
I recently work on Tricore Processor, but I have some problems.
With reading memory value. I do not know if I am right or not, but I think a part of flash memory copied to RAM and now in my algorithm ...
0
votes
0answers
28 views
How to use aarch64 call convention to understand an unknown function?
I’m trying to reverse engineer an aarch64 Golang binary which happens to call a symbol, i.e., function named guess_me which is an import. To stop the binary from throwing errors, I write a Hello World!...
1
vote
0answers
62 views
Delphi mt38 CRC (Tricore 1766 Arch)
I want to calculate CRC32 for Delphi mt38 and found the below assembly algorithm and converted it to C. It seems that this algorithm is defined for n = 256 or 1024. I want to calculate CRC32 for n = ...
3
votes
0answers
30 views
How can I tell whether or not a given library method is being referenced by a consumer program statically in OOP languages?
Preface: This question is about source code reverse engineering and static analysis. Meaning, there is no built code available but I have access to the source code of the program.
Imagine I'm looking ...
1
vote
0answers
64 views
CRC16 Reverse in C166 Arch
Before that I asked about piece of code that used in this algorithm (here). Now I have a bit problem with the rest of algorithm.
So I have to describe this with detail. Sorry if i vast your time for ...
0
votes
1answer
55 views
Static Binary in Windows
I am learning more about binary exploitation on windows. But I saw while revering a binary that you can create static binaries in windows too just like in Linux. It was really ugly. if I would be on ...
1
vote
0answers
34 views
Strange memory allocation behaviour
I'm currently working on a modding library for a particular game, and I have come across a part of the menu system that I can't figure out the purpose of.
The expression in question is this:
unsigned ...
0
votes
1answer
62 views
Password evaluated from the sum of ASCII letters
After analyzing the code, I have been able to understand and recreate the algorithm used to check if the password the binary takes is correct, but don't know how to solve it (or at least can't think ...
-3
votes
1answer
183 views
The C166 family code meaning
What the meaning of this code with an explanation?
sub_37C2:
mov r5, r4
shr r5, #14
shl r5, #1
mov r5, [r5+0FE00h] ; DPP0
bmov r4.14, r5.0
bmov r4.15, r5.1
shr r5, #2
rets
; ...
0
votes
2answers
117 views
Is manually converting/decompiling x86 source code to C/C++/etc… considered reverse engineering?
I have the source code of an old program written in 32-bit x86 assembler that I am working on manually rewriting in C.
The first time someone asked me about this project I told them I was 'reverse ...
1
vote
0answers
38 views
Statically injecting translated NASM assembly into existing ELF binary
I'm trying to statically patching ELF binaries in order to incorporate code that can help provide run-time protection.
In an effort to save time writing and debugging assembly, I took the following no-...
0
votes
0answers
21 views
Symbols for detecting UBSan
I am looking for the symbols that reveal if a specific binary was compiled with UBSan.
Unfortunately, Checksec is not able to detect it.
So, I have compiled the snippet reported in the official doc.
...
1
vote
0answers
55 views
Immediate offset LDR in presumed malloc function looks wrong in static analysis
I am attempting to disassemble a ROM image for a BCM4366C [1] after reading a blog post where researchers reversed some other Broadcom chips [2] . I have analyzed the ROM image in Ghidra and I have ...
0
votes
1answer
34 views
What is this line and how to remove it
I tried to unpack packed_dll, when the unpack stage done, i dumped unpacked_dll out and start to reverse. I pretty sure this is continuously function of that dll but this line show up. So what is this ...
-1
votes
1answer
114 views
How can I analyze this code? [closed]
I wanted to analyse the code for some functionality.
in my understanding the code contains a logic handling intents with extras. I want to know how these Works! and also how can I pass extras using ...
1
vote
0answers
92 views
Removing/bypassing a BIOS whitelist
I am trying to bypass or erase the BIOS whitelist on my Thinkpad T440p. So far I've
used flashrom and a soic8 clip to dump the bios to a bios.img file
made another dump and compared with diff bios....
0
votes
0answers
139 views
What are the known techniques used by wrappers and obfuscators to protect against decompiling?
I am NOT looking to make my application 99% safe, nor my goal is to prevent a a determined reverse-engineer to disassemble it, but simply is to protect my source code from lambda user with little ...
0
votes
1answer
66 views
ida identifies library function as regular function
I'm trying to find libc symbols in some Windows 32-bit application. For some reason, Ida autoanalysis didn't recognized code that comes from libc as "library function", but as a "regular function". ...
1
vote
0answers
49 views
ARM chip gpio/ identification from firmware code
Device: i was able to recover bricked Chinese IOT a Sous Vide cooker. Replaced damaged capacitor. it works.
it has
ARM soc/mcu/processor
WI-FI (broadcom)
LCD touch screen + 16bit STM mcu.
EEPROM ...
1
vote
1answer
44 views
methods that have zero usage in jadx?
so i've been reversing this ai assistant app to figure out what kind of forensic data it leaves on local file system. during static analysis with jadx-gui i found some interesting methods that take ...
1
vote
1answer
99 views
Dynamic analysis (Frida) reveals instance of a class that doesn't exist in the source code (dex2jar)
I have been diving into an apk's source code, doing both static analysis with Jadx (same as dex2jar) and dynamic analysis with Frida.
I am trying to replicate the method that signs HTTP requests "...
0
votes
0answers
38 views
static analysis for identifying backdoors
I am doing a research in identifying backdoors in windows .exe files. Currently I found some methods to detect.
1.String search in .exe
2.find Reffrence .dll and win32 Api calls using import table
...
0
votes
0answers
36 views
Is there any tool that finds common things like strings among large number of binaries?
So this is really needed in malware analysis, for example if i have 1000 samples from a family and i want to know which strings are common among all of them, it would really help to have a tool that ...
0
votes
1answer
366 views
Find functions signatures in Ida?
I didn't understand the subject of find function in Ida via signature.
If I understand well that way helps to recognize libraries functions in static binary(in dynamic binary I can see the functions ...
0
votes
1answer
51 views
PE file export functions of packed file
I am new to reverse engineering and I am learning about packed files.
I saw that most of the time I can recognize a packed file with a little number of import functions in PE file and not many strings ...
0
votes
0answers
31 views
How does BAP- BinaryAnalysisPlatform helps for reverse engineering
I saw the BAP- BinaryAnalysisPlatform as a helpful tool for reverse engineering.
Can you please explain me how does this BAP, helps for reverse engineering (I already use Ida pro)
0
votes
0answers
18 views
Open all object files in Ida
I have archive file , like libc.a .
When I tried to open it with ida, ida ask to choose one object file that contain in archive file.
Is there any way to open all the object files in one Ida project?...
1
vote
1answer
141 views
Find all syscall in statically Arm Binary
What is the easy and fast way to find all syscall in statically Arm binary ?
Is there any Ida plugin that do that?
0
votes
0answers
46 views
Python based static c analysis tools
I want to analyze some open-source C code, and I'm looking for a static analysis python library for C, preferably open-source. Any ideas/suggestions, based on your experience?
0
votes
1answer
96 views
Get function return value
any idea for more ways to get return value?
(no hooks, no hw/memory breakpoints, no call functions)
thx :)
tried to find dword maybe that hold the function return, didn't found.
I'm trying to create ...
1
vote
0answers
14 views
Locating Exit/Abort Functions from Static Analysis
Similar to this question, I'm interested in locating exit and abort style functions in a firmware - any function call that in fact terminates the execution, by statically analyzing the firmware.
My ...
0
votes
1answer
79 views
Can relative offsets in instructions like call and jmp change after recompiling the same code, or running it in another computer?
So let's say we want to use some instructions as signature for a malware, and it includes some call instructions or jmp instructions. Now, as far as I have seen, they always contain relative offsets ...
1
vote
1answer
134 views
How to extract static API sequences of a PE file?
How does one extract the static API sequences of a PE file? I don't mean the imports listed in the imports segment.
I am currently using different RE tools like Ghidra, IDA Pro, and Binary Ninja. ...
1
vote
0answers
34 views
IDA Pro SP tracking
I am reversing a BIOS and its code extensively uses SP register for 16-bit return addresses (and also things like "bswap ESP" to obtain a "two-level-deep" stack, and rarely "mov mm7, esp" to obtain a "...
0
votes
1answer
255 views
Obfuscated VBE malware script analysis
Some actions of this script are clear e.g. the section that adds firewall rules, others not so much
On Error Resume Next
F27
F10
A0
DBCF
Sub F27()
Dim E13C563AFCB34, C0009B48F34B, C8, ...
0
votes
1answer
105 views
Detecting libc function with IDA
I have binary than running on Arm , static and striped.
I don't know which compiler compiled this binary.
How can I identify function like fread sleep printf ioctl
1
vote
1answer
88 views
Memory map in AVR Harvard architecture
In this video https://youtu.be/D0VKuZuuvW8?t=259 .
You can see that flash address is beteen 0x0 to 0x3fff. and Data memory ( Io register and SRAM ) is between 0x0 to 0x8ff .
So in the video he ask ...
0
votes
1answer
76 views
IDA Change ram and rom without reopen IDA
when I open binary and write ram and rom , I don't know how to change it (and re parse all the binary) without close and open again the binary.
Is there any smart way ?
1
vote
2answers
1k views
Why Windows Defender is not able to get rid of this trojan?
Every time I start my PC, Windows Defender shows a notification saying that the virus Trojan:Win32/Ceprolad.A was deleted, which means indeed that it wasn't, as most antivirus I've tried these days (...
1
vote
0answers
52 views
static core dump analysis
I got a coredump from an unknow binary. I want to retrieve as many information as possible (memory, register, contexte..)
Most of the answers available on the web speak about coredump analysis using ...
5
votes
0answers
149 views
Radare2 8051 code bank switching
Some of 8051 chips use bank switching to extend accessible code memory.
Good example is Silabs C8051F12x. Another example is here.
Code area in range 0x0000..0x7ffff is common always accessible code ...
1
vote
1answer
95 views
Finding a mathematical calculation which uses Pi within binary
Given a large (~14MB) binary compiled for a X86 64-bit system, what would be the basic steps to go through in order to find the usage of Pi (π) for calculation of a certain parameter (flag)?
I'm ...
2
votes
1answer
140 views
APK static analysis tools - frameworks used, vulnerability checks, etc? [closed]
I'm familiar with tools for unpacking/decompiling APKs - JADX, apktool, dex2jar, JD-GUI, and the like. I'm curious if there are tools which automate other useful tasks when reversing an APK, such as:
...
1
vote
1answer
202 views
How to restore IAT?
I have the start address and the end address of the IAT
now im trying to restore the table/folder of it.
the start address is: E7C000
thx for helping
-1
votes
1answer
2k views
How do I find the address of a data location at runtime?
I'm using ghidra and cheat engine to reverse engineer a game's function. In ghidra's decompiler this function references two locations known as _DAT_XXX. I know the addresses of these locations in the ...
