Questions tagged [static-analysis]

Static analysis is the analysis code without actually executing it. This is in contrast to dynamic analysis which executes the code.

Filter by
Sorted by
Tagged with
0
votes
1answer
47 views

Obfuscated VBE malware script analysis

Some actions of this script are clear e.g. the section that adds firewall rules, others not so much On Error Resume Next F27 F10 A0 DBCF Sub F27() Dim E13C563AFCB34, C0009B48F34B, C8, ...
0
votes
1answer
39 views

Detecting libc function with IDA

I have binary than running on Arm , static and striped. I don't know which compiler compiled this binary. How can I identify function like fread sleep printf ioctl
1
vote
1answer
37 views

Memory map in AVR Harvard architecture

In this video https://youtu.be/D0VKuZuuvW8?t=259 . You can see that flash address is beteen 0x0 to 0x3fff. and Data memory ( Io register and SRAM ) is between 0x0 to 0x8ff . So in the video he ask ...
0
votes
1answer
29 views

IDA Change ram and rom without reopen IDA

when I open binary and write ram and rom , I don't know how to change it (and re parse all the binary) without close and open again the binary. Is there any smart way ?
1
vote
2answers
175 views

Why Windows Defender is not able to get rid of this trojan?

Every time I start my PC, Windows Defender shows a notification saying that the virus Trojan:Win32/Ceprolad.A was deleted, which means indeed that it wasn't, as most antivirus I've tried these days (...
1
vote
0answers
27 views

static core dump analysis

I got a coredump from an unknow binary. I want to retrieve as many information as possible (memory, register, contexte..) Most of the answers available on the web speak about coredump analysis using ...
1
vote
0answers
46 views

Radare2 8051 code bank switching

Some of 8051 chips use bank switching to extend accessible code memory. Good example is Silabs C8051F12x. Another example is here. Code area in range 0x0000..0x7ffff is common always accessible code ...
1
vote
1answer
85 views

Finding a mathematical calculation which uses Pi within binary

Given a large (~14MB) binary compiled for a X86 64-bit system, what would be the basic steps to go through in order to find the usage of Pi (π) for calculation of a certain parameter (flag)? I'm ...
2
votes
1answer
93 views

APK static analysis tools - frameworks used, vulnerability checks, etc? [closed]

I'm familiar with tools for unpacking/decompiling APKs - JADX, apktool, dex2jar, JD-GUI, and the like. I'm curious if there are tools which automate other useful tasks when reversing an APK, such as: ...
0
votes
1answer
99 views

How to restore IAT?

I have the start address and the end address of the IAT now im trying to restore the table/folder of it. the start address is: E7C000 thx for helping
0
votes
0answers
38 views

Add MessageBox statically modify

So i'm doing this challenge which i have an exe file and a dll all i have to do is modify it statically to pop a MessageBox. The exe file is loading the dll which load the MessageBox, with ollydbg ...
-1
votes
1answer
126 views

How do I find the address of a data location at runtime?

I'm using ghidra and cheat engine to reverse engineer a game's function. In ghidra's decompiler this function references two locations known as _DAT_XXX. I know the addresses of these locations in the ...
1
vote
0answers
22 views

Parse / statically analyzing .NET binaries using python

Which libraries do you use to parse and statically analyze .NET binaries? Is there a python module, or do I have to use a .NET library such as dnlib? Does it make sense to write a python wrapper for ...
0
votes
1answer
83 views

How to find who use these strings?

When i see function like this, im getting confused, because all the strings i need in this function, but how can i find which functions which this strings? how can i know the address of the function ...
1
vote
2answers
127 views

Trouble when reverse engineering a industrial robot software in order to get some values

For the bit of background, I'm a robotic engineer. Robotics manufactures hide some parameters of their robots in order to avoid their competition. Now, I need these data to compute the dynamics model ...
1
vote
0answers
77 views

Reconstructing struct/union-based IPC protocol wire format

I'm embarking on my first reverse-engineering adventure. I think I've picked a rather dense piece of steak to start out with. I have three C programs which communicate together using an unknown IPC ...
1
vote
1answer
157 views

Identify function in cpp static binary

When I open cpp static binary, how can identify known functions like fopen/ioctl/printf? They have been compiled statically into the binary. I dont know the compiler of this binary .
1
vote
1answer
105 views

pyelftools relocation section symbols

I have been trying to get into reverse engineering as of late and after playing with Radare2 I realized I was playing with a lot of things without really understanding what I was doing. In an effort ...
0
votes
1answer
69 views

Automatically detecting and carving images from .doc, .docx and spreadsheets

I'm looking for a tool that can extract detect and extract any image format from word documents in both .doc and .docx formats for an automatic document classification use case. It is nice to just ...
1
vote
1answer
218 views

How to find the starting address of main function when the binary is stripped and _start doesn't push the absolute address value of main?

So let's say the ELF binary is stripped - meaning no symbol table - and the _start function doesn't push the address of main before calling __libc_start_main. This happened in a binary when compiled ...
0
votes
1answer
119 views

How can I know what the executable is missing to run?

I have extracted a presence of MZ file from memory which happen to be available in virustotal ( might be a malicious executable). However, I could not run the program. It seems to have some missing ...
0
votes
1answer
88 views

me_cleaner and fwupd, or manipulating UEFI .cab files

I'd like to extract a plain dump of the UEFI firmware of my laptop (1:1 copy of the flash content, often called .bin or .rom files) from the .cap file, so that I can modify it slightly with me_cleaner....
4
votes
1answer
777 views

Can I define custom enum-type to be used in Ghidra as a data type?

I'm trying to learn Ghidra. Say, if it generated the following code for loading functions from an array of function names from gpfnCommCtrlAPI: I was able to retype gpfnCommCtrlAPI into char*[14] ...
0
votes
1answer
55 views

what does BYTES_REVERSED_HI and BYTES_REVERSED_LO in an PE signify

How can these pe attributes be used to identify malware. I was going though a paper link at page 10 he mentioned. "BYTES_REVERSED_HI and BYTES_REVERSED_LO both make ideal candidates as a primary ...
0
votes
0answers
295 views

Finding function call (with arguments) in ELF file

I have two kinds of ELF files, built from C++. .so files: ELF 64-bit LSB shared object, x86-64, version 1 (GNU/Linux), dynamically linked, BuildID[sha1]=5e751e769912aef28bc63b888e5e4904b867a180, ...
1
vote
0answers
80 views

Saving IDA Graph to PDF format?

I want to save flow/call graph of IDA into a pdf format so that I could view it in my android. How can I do that? I know IDA can generate a flow chart (gdl file) and call chart (gdl file). But my ...
3
votes
1answer
440 views

Radare2 Disassembler How Do You Organize Visual Panels (V!)?

I would like to use Radare2 to learn about how C is assembled into assembly but I am having trouble with the layout. I think the V! mode would be very handy as you can watch the registers update as ...
1
vote
1answer
386 views

Debugger Win32 Local vs WinDbg in Ida vs Ollydbg

When I do dynamic analyze of exe file I have few option , and I want to know what are the advantages and disadvantages. I know that Ida designated for static analyze , but there are some debugger in ...
0
votes
1answer
134 views

Start Symbolic Analysis at a Given Address with Angr

Lets suppose I have a very big binary and I want to reverse just a part of this binary. Is there a way to tell angr to start symbolic analysis at a given address ?
1
vote
1answer
115 views

IDA - large jump table, missing cases in analysis

I have come across the following jump table with a large amount of cases (160+). There seems to be cases missing from IDAs analysis though. For example it skips from cases 22 -> 38 -> 91, and I can ...
2
votes
1answer
100 views

Why does -A (aaa) analysis show much more information, when using the -d (debug) CLI option in Radare2?

Why does -A (aaa) analysis show much more information, when using the -d (debug) CLI option in Radare2? I'm using the newest version of Radare2 to analyze the Windows application. As can be seen ...
2
votes
1answer
407 views

How to reverse engineer a Black Box?

I am trying to reverse engineer / research a black box system, this is, a system for which there is no public information at all. Let's say the system is a modern handheld console. I have already ...
0
votes
1answer
70 views

Reverse engineering Infostealer.Dyre

I'm a newbie to malware analysis and reverse engineering in general. I got hold of a Dyre malware sample from theZoo on GitHub and I've been trying to analyze it. I've put up my analysis report here. ...
1
vote
1answer
615 views

Radare's `aaaa` and -AA what does it do, exactly?

When I run aaa, Radare tells me, [x] Use -AA or aaaa to perform additional experimental analysis. But what does aaaa do? It's not documented under aa? nor aaa? nor [0x000028e0]> aaa? Usage: See ...
1
vote
1answer
194 views

Learning fine grained analysis in Radare with `a`?

The Radare community generally seems to look down upon simply running AAA or AAAA claiming that you need to instead learn the fine grained analysis and what they do. However, there seems to be no ...
2
votes
3answers
425 views

Is this a good way to get past anti-debugging measures?

This program I am analyzing is full of anti-debugging. It won't even run if most debuggers are loaded before I start the app. I tried using IDA to static analyze it, but it was written in a OOP ...
5
votes
1answer
3k views

Emulating Routers and other Embedded Devices with QEMU

I'm thinking about reverse engineering a few router models and trying to get them running with QEMU. In particular I'm trying to get the web server running. The current issue I'm thinking might be a ...
1
vote
1answer
148 views

Reverse Engineering Flat Data File

I'm writing a piece of software that will take positional data from a piece of software called Pyware and put it into a GUI so I can visualize the coordinates and assign each coordinate a color. ...
1
vote
1answer
77 views

Windbg's “dt” equivalent in IDA?

I wanted to ask whether there is a simple way to see an object's structure (like windbg's "dt" command equivalent)? Assuming of course I have the pdb file. Thank you :)
3
votes
2answers
219 views

Hybrid binary analysis tool

I have an idea to merge static and dynamic analysis into a visualization through the IDA python scripting interface. The concept involves automatically setting breakpoints at each function or basic ...
3
votes
2answers
52 views

Finding a particular call to an offset within a vtable using pattern matching

Let's say I have a very simple pattern I'm looking for. E.g. the following regex, mov.*(eax|edx|ecx|esi|edi), \[(eax|edx|ecx|esi|edi)\+30h\] Now, I'm also looking for references to this in which the ...
7
votes
1answer
188 views

How to detect internal and shared libraries used in an executable file?

Problem: We want to be able to tell with some certainty that specific versions of internal libraries are being used by a program. For example, if a software uses old, deprecated libraries internally. ...
3
votes
1answer
150 views

Basic hello world stack manipulation troubles

I'm a beginner in reverse engineering, and as a beginner I started to read "Reverse Engineering for beginers". Here is the hello world program from the book (taken from chapter 3, page 12) : Now ...
-1
votes
1answer
94 views

Understanding what is represented by function pointers to a block of hex

I'm working on a disassembly project for my class where I'm trying to bypass a license check, but when I throw the executable into Binary Ninja this is what I see: And when I look at those pointers, ...
2
votes
2answers
85 views

find equation based on multiple sets of 2 variables and results

I'm currently trying to reverse engineer a few equations used in a game, and have collected what seems to be all the relevant data. In the example below, result speed is definitely based solely on ...
6
votes
0answers
244 views

How to find if a given library function is used in a binary?

Assuming that library X is statically linked, is there a way to know with an acceptable grade of confidence if a function from it was used in the binary? I am currently using this approach: Convert ...
0
votes
1answer
535 views

Parsing .rodata (ELF)

IDA pro is able to display the data contained in the read only data section of ELF files, but the section is defined as type SHT_PROGBITS. To my knowledge, we cannot parse sections of this type to ...
1
vote
1answer
47 views

IDA search results not showing up in a separate window

I'm just learning to use IDA and according to the book, when using Search function (Search>text..., for example) I should see a window with the found results, like this: However, when the search ...
1
vote
1answer
161 views

Which RE tool is missing?

I am analyzing a malware at the moment which scans for a lot of filenames and ClassNames to recognize if it is under supervision or not. My problem is, that all the filenames and ClassNames are ...
2
votes
1answer
662 views

No apparent entry point for stripped, PIE binary using radare2

I am running on 64-bit Windows 7 and am using radare2 to attempt both static and dynamic analysis of a binary executable. The issue is that I cannot seem to find the entry point of where the program ...