Questions tagged [static-analysis]

Static analysis is the analysis code without actually executing it. This is in contrast to dynamic analysis which executes the code.

Filter by
Sorted by
Tagged with
35
votes
3answers
11k views

How can I reverse optimized integer division/modulo by constant operations?

When compiling a division or modulo by a constant, my compiler (LLVM GCC) generates a series of instructions that I don't understand. When I compile the following minimal examples: int mod7(int x) { ...
25
votes
6answers
3k views

Tools to work cooperatively on the same binary

What's a working tool/methodology to work cooperatively on the same binary (if possible in parallel), that is proven to work? I used various methods long ago to share information with others, but not ...
21
votes
1answer
6k views

Static analysis of C++ binaries

When reverse engineering binaries compiled from C++, it is common to see many indirect calls to function pointers in vtables. To determine where these calls lead, one must always be aware of the ...
11
votes
2answers
2k views

Protect data stored in binary

Let's say I've some function(i.e. hash function), that generates value from input seed and some precomputed hash values, that are stored somewhere in binary. What are the possible approaches for: ...
3
votes
1answer
599 views

Computing subtracted stack space for a function manually

Lets assume this function frame : How to calculate and check if subtracted stack space by line 3 is 58h ?: sub esp, 58h And this is the code, the compiler is also Dev C++: #include <stdio.h> ...
50
votes
7answers
124k views

How to know in which language/technology program (.exe) is written?

How to understand if exe/dll is written in C++/.Net/Java or in any other language. I tried to use Dependency walker but not able to get required information.
15
votes
3answers
5k views

Code Coverage - Fuzzing

I have been fuzzing Adobe Reader lately. One of the issues that I face is Code coverage. How do I determine that I have covered all the basic blocks in Adobe Reader and it's libraries. Is there any ...
19
votes
4answers
6k views

How common are virtualized packers in the wild?

I'm just getting into the RE field, and I learned about virtualized packers (like VMProtect or Themida) in a class about a year ago. How often is malware in the wild really packed with virtualized ...
14
votes
4answers
5k views

INT 2D Anti-Forensic Method

Inclusion of an INT 2D instruction appears to be a fairly common anti-debugging tactic used by Windows malware authors. From what I understand, it causes a process to act differently when a debugger ...
8
votes
3answers
2k views

Re-engineering to create UML Diagrams from Source and Binary

Are there tools that would create: UML Structural Diagrams from Source Code. UML Behavioral Diagrams from Binary executing on a arm / x86 system. Sources would be in C &/ C++ &/ Python. ...
16
votes
4answers
4k views

How to recover variables from an assembly code?

Assuming we have an assembly code, what are the known techniques that could be used to recover the variables used in the original high-level code ? Edit: By recovering variables, I do not mean ...
10
votes
2answers
2k views

How to do static analysis to identify pointer from concrete value in assembly?

So basically I am writing some code to do analysis work on disassembled assembly code. I am trapped in this issue for a while, here is an simple example of a disassembled asm code by objdump, ...
4
votes
2answers
740 views

Locating Memory Allocation Functions from Static Analysis

I'm currently working on reversing a firmware binary for an embedded device. This device is using an uncommon architecture: it is a modified Harvard architecture, running on a TMS320C55x chipset with ...
3
votes
2answers
2k views

Reverse engineering UEFI CAP files

I'm looking to identify code changes in the latest UEFI release for my motherboard, to verify whether the changes include mitigations for the row hammer vulnerability. I'm specifically looking at the ...
2
votes
2answers
1k views

Generating call graph for assembly instructions

I'm writing a tool and I need to generate the callgraph for assembly instructions. But I do not know how to exactly generate call graph from assembly instruction. Do you have any idea? To clarify, I ...
4
votes
1answer
254 views

Wierd names in import table

I'm trying to do a static analysis of a PE file to see what it does. While doing so, I stumbled upon some really wierd function names in my objdump DLL Name: msvcrt.dll vma: Hint/Ord Member-Name ...
3
votes
1answer
1k views

Is the magic number important

While checking the PE header of DLLs and EXE(s) by PEviewer, I found something called "magic number". After googling "magic number". I found that it is used to determine the file type. My question ...
1
vote
3answers
1k views

Decompress and Analyse VMWARE EFI64 bios

I want to analyse this UEFI bios here. When I open it in IDA it looks compressed to me. Also IDA lists the processor type as ZLOG. Shouldn't this be the multi processor setting for IDA? Anyway, If I ...
0
votes
0answers
46 views

Using GDB to find the address of a buffer in a stripped C binary

I am working with a crackmes binary called Simple Overflow. It has two buffers with sizes 0x10 and 0x8, and it uses malloc to allocate two contiguous memory blocks (see <+25> and <+39> on ...
-3
votes
1answer
229 views

The C166 family code meaning

What the meaning of this code with an explanation? sub_37C2: mov r5, r4 shr r5, #14 shl r5, #1 mov r5, [r5+0FE00h] ; DPP0 bmov r4.14, r5.0 bmov r4.15, r5.1 shr r5, #2 rets ; ...