Questions tagged [static-analysis]

Static analysis is the analysis code without actually executing it. This is in contrast to dynamic analysis which executes the code.

Filter by
Sorted by
Tagged with
37 votes
3 answers

How can I reverse optimized integer division/modulo by constant operations?

When compiling a division or modulo by a constant, my compiler (LLVM GCC) generates a series of instructions that I don't understand. When I compile the following minimal examples: int mod7(int x) { ...
Dougall's user avatar
  • 1,789
27 votes
6 answers

Tools to work cooperatively on the same binary

What's a working tool/methodology to work cooperatively on the same binary (if possible in parallel), that is proven to work? I used various methods long ago to share information with others, but not ...
Ange's user avatar
  • 6,694
23 votes
1 answer

Static analysis of C++ binaries

When reverse engineering binaries compiled from C++, it is common to see many indirect calls to function pointers in vtables. To determine where these calls lead, one must always be aware of the ...
user1354557's user avatar
  • 1,234
11 votes
2 answers

Protect data stored in binary

Let's say I've some function(i.e. hash function), that generates value from input seed and some precomputed hash values, that are stored somewhere in binary. What are the possible approaches for: ...
see ya's user avatar
  • 823
3 votes
1 answer

Computing subtracted stack space for a function manually

Lets assume this function frame : How to calculate and check if subtracted stack space by line 3 is 58h ?: sub esp, 58h And this is the code, the compiler is also Dev C++: #include <stdio.h> ...
Vlad's user avatar
  • 139
56 votes
7 answers

How to know in which language/technology program (.exe) is written?

How to understand if exe/dll is written in C++/.Net/Java or in any other language. I tried to use Dependency walker but not able to get required information.
Pranit Kothari's user avatar
20 votes
4 answers

How common are virtualized packers in the wild?

I'm just getting into the RE field, and I learned about virtualized packers (like VMProtect or Themida) in a class about a year ago. How often is malware in the wild really packed with virtualized ...
Andrew's user avatar
  • 413
16 votes
4 answers

INT 2D Anti-Forensic Method

Inclusion of an INT 2D instruction appears to be a fairly common anti-debugging tactic used by Windows malware authors. From what I understand, it causes a process to act differently when a debugger ...
lynks's user avatar
  • 263
16 votes
4 answers

How to recover variables from an assembly code?

Assuming we have an assembly code, what are the known techniques that could be used to recover the variables used in the original high-level code ? Edit: By recovering variables, I do not mean ...
perror's user avatar
  • 19.1k
16 votes
3 answers

Code Coverage - Fuzzing

I have been fuzzing Adobe Reader lately. One of the issues that I face is Code coverage. How do I determine that I have covered all the basic blocks in Adobe Reader and it's libraries. Is there any ...
john4tech's user avatar
  • 595
10 votes
2 answers

How to do static analysis to identify pointer from concrete value in assembly?

So basically I am writing some code to do analysis work on disassembled assembly code. I am trapped in this issue for a while, here is an simple example of a disassembled asm code by objdump, ...
lllllllllllll's user avatar
8 votes
3 answers

Re-engineering to create UML Diagrams from Source and Binary

Are there tools that would create: UML Structural Diagrams from Source Code. UML Behavioral Diagrams from Binary executing on a arm / x86 system. Sources would be in C &/ C++ &/ Python. ...
AjayKumarBasuthkar's user avatar
4 votes
2 answers

Locating Memory Allocation Functions from Static Analysis

I'm currently working on reversing a firmware binary for an embedded device. This device is using an uncommon architecture: it is a modified Harvard architecture, running on a TMS320C55x chipset with ...
InfectedPacket's user avatar
4 votes
1 answer

Wierd names in import table

I'm trying to do a static analysis of a PE file to see what it does. While doing so, I stumbled upon some really wierd function names in my objdump DLL Name: msvcrt.dll vma: Hint/Ord Member-Name ...
muchwow's user avatar
  • 153
4 votes
2 answers

Reverse engineering UEFI CAP files

I'm looking to identify code changes in the latest UEFI release for my motherboard, to verify whether the changes include mitigations for the row hammer vulnerability. I'm specifically looking at the ...
Polynomial's user avatar
  • 1,272
3 votes
1 answer

Is the magic number important

While checking the PE header of DLLs and EXE(s) by PEviewer, I found something called "magic number". After googling "magic number". I found that it is used to determine the file type. My question ...
Ahmed's user avatar
  • 135
2 votes
2 answers

Generating call graph for assembly instructions

I'm writing a tool and I need to generate the callgraph for assembly instructions. But I do not know how to exactly generate call graph from assembly instruction. Do you have any idea? To clarify, I ...
user2942756's user avatar
1 vote
3 answers

Decompress and Analyse VMWARE EFI64 bios

I want to analyse this UEFI bios here. When I open it in IDA it looks compressed to me. Also IDA lists the processor type as ZLOG. Shouldn't this be the multi processor setting for IDA? Anyway, If I ...
LUser's user avatar
  • 793
0 votes
0 answers

Using GDB to find the address of a buffer in a stripped C binary

I am working with a crackmes binary called Simple Overflow. It has two buffers with sizes 0x10 and 0x8, and it uses malloc to allocate two contiguous memory blocks (see <+25> and <+39> on ...
Ronald Rivera's user avatar
-2 votes
1 answer

The C166 family code meaning

What the meaning of this code with an explanation? sub_37C2: mov r5, r4 shr r5, #14 shl r5, #1 mov r5, [r5+0FE00h] ; DPP0 bmov r4.14, r5.0 bmov r4.15, r5.1 shr r5, #2 rets ; ...
Unicornux's user avatar
  • 147