Questions tagged [static-analysis]

Static analysis is the analysis code without actually executing it. This is in contrast to [tag:dynamic-analysis] which executes the code.

18 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
8
votes
2answers
949 views

Automated Static Unpacking Binaries

I am reading the paper Automatic Static Unpacking of Malware Binaries (Kevin Coogan et al.) with the goal of trying to reproduce the given experimental results (with Hybris-C, MyDoom.q, tElock, etc), ...
6
votes
0answers
222 views

How to find if a given library function is used in a binary?

Assuming that library X is statically linked, is there a way to know with an acceptable grade of confidence if a function from it was used in the binary? I am currently using this approach: Convert ...
4
votes
1answer
634 views

Can I define custom enum-type to be used in Ghidra as a data type?

I'm trying to learn Ghidra. Say, if it generated the following code for loading functions from an array of function names from gpfnCommCtrlAPI: I was able to retype gpfnCommCtrlAPI into char*[14] ...
2
votes
1answer
367 views

Is this a good way to get past anti-debugging measures?

This program I am analyzing is full of anti-debugging. It won't even run if most debuggers are loaded before I start the app. I tried using IDA to static analyze it, but it was written in a OOP ...
2
votes
0answers
330 views

Is there a static data flow analysis tool for .net assemblies?

I read here that CAT.NET and FxCop are dead. As far as I understand, the successor Roslyn requires a visual studio project and source code. Is there a tool that reads in a compiled .NET program and ...
1
vote
0answers
23 views

static core dump analysis

I got a coredump from an unknow binary. I want to retrieve as many information as possible (memory, register, contexte..) Most of the answers available on the web speak about coredump analysis using ...
1
vote
0answers
36 views

Radare2 8051 code bank switching

Some of 8051 chips use bank switching to extend accessible code memory. Good example is Silabs C8051F12x. Another example is here. Code area in range 0x0000..0x7ffff is common always accessible code ...
1
vote
0answers
22 views

Parse / statically analyzing .NET binaries using python

Which libraries do you use to parse and statically analyze .NET binaries? Is there a python module, or do I have to use a .NET library such as dnlib? Does it make sense to write a python wrapper for ...
1
vote
0answers
48 views

Reconstructing struct/union-based IPC protocol wire format

I'm embarking on my first reverse-engineering adventure. I think I've picked a rather dense piece of steak to start out with. I have three C programs which communicate together using an unknown IPC ...
1
vote
1answer
84 views

pyelftools relocation section symbols

I have been trying to get into reverse engineering as of late and after playing with Radare2 I realized I was playing with a lot of things without really understanding what I was doing. In an effort ...
1
vote
0answers
70 views

Saving IDA Graph to PDF format?

I want to save flow/call graph of IDA into a pdf format so that I could view it in my android. How can I do that? I know IDA can generate a flow chart (gdl file) and call chart (gdl file). But my ...
1
vote
0answers
71 views

Where can I get a good description about windows build-in exe programs like wupdmgr.exe?

I was checking the Strings for Lab01-04.exe from Practical Malware Analysis and I found wupdmgr.exe and I face this every time I search for an exe. Is there any "msdn" alike repository but for exe ...
1
vote
0answers
427 views

Static binary instrumentation tools for android .so libraries?

I'm trying to statically inject code into an android app. The best way would be to use APKStudio and the like, but there are very harsh restrictions on the device and the app itself, so that apk ...
0
votes
1answer
83 views

How to restore IAT?

I have the start address and the end address of the IAT now im trying to restore the table/folder of it. the start address is: E7C000 thx for helping
0
votes
0answers
37 views

Add MessageBox statically modify

So i'm doing this challenge which i have an exe file and a dll all i have to do is modify it statically to pop a MessageBox. The exe file is loading the dll which load the MessageBox, with ollydbg ...
0
votes
1answer
65 views

How to find who use these strings?

When i see function like this, im getting confused, because all the strings i need in this function, but how can i find which functions which this strings? how can i know the address of the function ...
0
votes
1answer
106 views

How can I know what the executable is missing to run?

I have extracted a presence of MZ file from memory which happen to be available in virustotal ( might be a malicious executable). However, I could not run the program. It seems to have some missing ...
0
votes
0answers
228 views

Finding function call (with arguments) in ELF file

I have two kinds of ELF files, built from C++. .so files: ELF 64-bit LSB shared object, x86-64, version 1 (GNU/Linux), dynamically linked, BuildID[sha1]=5e751e769912aef28bc63b888e5e4904b867a180, ...