Questions tagged [static-analysis]

Static analysis is the analysis code without actually executing it. This is in contrast to dynamic analysis which executes the code.

Filter by
Sorted by
Tagged with
-2
votes
1answer
82 views

Malware static rules? [closed]

Is there any sites to get static rules to detect malware files? static behavior rules for detecting malware files. Thanks in advance.
1
vote
1answer
887 views

Elf file format finding .got and .got.plt segments

I'm writing ELF parser and simple disassembler x86. Having code like this .text:000B5A2A call 0000B470 ;e.g. _glXSwapBuffers ... ... got.plt:0000B470 jmp dword ptr [ebx+240h] ;jump to ....
1
vote
1answer
370 views

re-construction of c code: movsx with test instruction

I just started learning about reconstructing C code from assembler instructions. I have the following piece of assembler code: mov eax dword ptr [ebp+8] add eax, dword ptr[ebp-4] movsx ecx, byte ptr ...
0
votes
2answers
2k views

How to unpack and decrypt malware? [duplicate]

Recently I have been working on reverse engineering of binary samples and executables of known malware. Most of them have been packed or encrypted. And to reach the actual data or part of the program ...
1
vote
3answers
573 views

Decompress and Analyse VMWARE EFI64 bios

I want to analyse this UEFI bios here. When I open it in IDA it looks compressed to me. Also IDA lists the processor type as ZLOG. Shouldn't this be the multi processor setting for IDA? Anyway, If I ...
1
vote
1answer
135 views

What are the overall features used in static analysis of malware? Is file property among the features used in static analysis of malware?

I was looking at the paper: "Improved Detection for Advanced Polymorphic Malware" by James Fraley who claimed to have used static, dynamic and file properties for increased malware detection. But is ...
2
votes
1answer
178 views

How to detect overlay data in RTF files?

How to detect overlay data in RTF files? When officemalscanner says it detected overlay data, what does that mean ? Is overlay data specific to malicious files ?
5
votes
1answer
490 views

How can I get the shared libraries' function calls using angr

I am trying to get all the library function calls that a binary performs in a preorder-DFT traversal of the CFG. I'm able to get the CFG like: import sys, angr import networkx as nx proj = angr....
0
votes
1answer
7k views

Reverse engineering a golang binary file

I compiled docker by myself with some modifications. I would like to perform some static analysis to the binary. Mostly to see which parts of the code take more memory, etc. It's on linux (elf). Any ...
1
vote
1answer
129 views

What does this sequence of numbers mean?

so i'm reversing a file format of game. As far as i can understand the file i'm trying to reverse contains compressed textures. I'm already able to locate the textures and decompress them, but i'm not ...
1
vote
0answers
71 views

Where can I get a good description about windows build-in exe programs like wupdmgr.exe?

I was checking the Strings for Lab01-04.exe from Practical Malware Analysis and I found wupdmgr.exe and I face this every time I search for an exe. Is there any "msdn" alike repository but for exe ...
1
vote
1answer
919 views

Dose PE Explorer unpack upx executables?

I was analysing Lab01-02.exe from Practical Malware Analysis book, the exe is packed with upx, since it showed UPX0, 1, 2 in the header section when analyzed with PEview, but when I open the same exe ...
8
votes
2answers
968 views

Automated Static Unpacking Binaries

I am reading the paper Automatic Static Unpacking of Malware Binaries (Kevin Coogan et al.) with the goal of trying to reproduce the given experimental results (with Hybris-C, MyDoom.q, tElock, etc), ...
0
votes
2answers
544 views

How to get better in re?

I'm a junior security researcher, and I'm interested in improving my ability in RE. I am a programmer at Assembly and C (and python and a few more high level lang). I learned and know how to use ...
3
votes
2answers
646 views

How to get elf header via IDAPython?

In IDAPython, we can get segments with idautils.Segments().However, the result doesn't cover the whole input file, and the the first segment is ".init". My question is, how to get other things in the ...
-2
votes
1answer
92 views

Need help in understanding the code of a “Malicious” file [closed]

I'm testing a malware sample : hxxps://www.virustotal.com/en/file/55f4cc0f9258efc270aa5e6a3b7acde29962fe64b40c2eb36ef08a7a1369a5bd/analysis/ This is a malicious executable file. When executed in ...
4
votes
2answers
688 views

Dalvik dex file version 036

I came upon a sample that indirectly contains classes.dex with the magic "Dalvik dex file version 036". If not for the version, the file seems to be normal and JEB loads it without any problem. But ...
2
votes
0answers
339 views

Is there a static data flow analysis tool for .net assemblies?

I read here that CAT.NET and FxCop are dead. As far as I understand, the successor Roslyn requires a visual studio project and source code. Is there a tool that reads in a compiled .NET program and ...
7
votes
1answer
241 views

Is there a way to find out which hash standard by studying the source code?

We have an embedded product, which we are carrying for several hardware iterations since more than 5 years ago. We have all the source code, most of it nicely documented. As the product is actively ...
3
votes
1answer
3k views

Are there any static binary rewriting tools?

My goal is to modify some instructions and make some instrumentation in ELF executables or libraries(For example, modifying all memory writes instructions). Since there're so many instructions, I want ...
0
votes
2answers
164 views

Identifying a very weak hash algorithm

I'm reverse-engineering a string translation file format for a particular game. It's ultimately just an ID-to-string map, where the IDs are four-byte integers. There are 1935 IDs in total; you can see ...
3
votes
1answer
88 views

How would one find test cases for a self-implemented value set analysis (VSA)?

I read a blog post about value set analysis (VSA). For VSA, see e.g. here. The blog author writes I’ve been trying to get to the point where the example in Balakrishnan’s dissertation works. I ...
2
votes
2answers
338 views

Programmatically reverse-engineering a dynamic dispatch method

Background: I want to convert Qt RTTI into symbols, to more easily navigate a large executable. If you don't know already, Qt is a C++ application framework based on a message passing system. Since C+...
1
vote
2answers
150 views

Automated Branch Input Generation

Theoretically it should be possible for a binary analysis tool such as IDA to generate an input that will trigger a specific branch patch. So for example an executable that takes in a command line ...
0
votes
1answer
163 views

Get driver binary

I am running an application that just after starting, it creates a service (process hacker tool notifies me that driver_app.sys has been created). Indeed, it says that the location of driver_app.sys ...
8
votes
3answers
2k views

Control flow graph reconstruction projects

I'm looking for projects providing reconstructed Control Flow Graphs from binaries while supporting more than one platform (e.g. x86, x64, arm). For example, considering this short assembler program: ...
1
vote
1answer
236 views

IDA Hex-Rays Generating Redundant Code

Hex-Rays generated C code is adding a lot of redundancy code, and I cannot figure out why and it really frustrates me to remove them manually on my reverse engineering process. if ( v1 ) { v15....
3
votes
1answer
666 views

Resolving symbols of statically linked libraries in a binary

assuming i got an statically linked libraries (for example, openssl) inside some binary. What is a good way to resolve the library symbols ? is there any IDA plugin for that job? I presume that I ...
1
vote
2answers
176 views

Obfuscation by changing the order of a malware behaviour

I know that there are some obfuscation techniques which can lead to slowing or even failing the detection of malware when static analysis is used. However, is there a similar technique that changes ...
0
votes
1answer
236 views

What is the relationship between the Windows API and the C run time library? [closed]

I have two reports of static and dynamic malware analysis. There are some APIs of MSVCRT's dll in my static report, which are missing in the dynamic report. (such as _p_commode, _setusermatherr, etc.) ...
1
vote
1answer
878 views

How to search sequence of API call using IDA Pro?

I want to search the sequence of API call using IDA Pro. How to search the API call node execution and what is the next API call node execution followed using IDA Pro.
1
vote
1answer
789 views

Function dependencies in static libraries

I read in another SO thread: With static libraries, the unit of copying is the object file in the library. In other words, if two programs call a function from a certain object file, both ...
1
vote
1answer
1k views

Resolving DLL function names using ordinals

I am trying to figure out how to get the imports of a PE using the PEfile python project (https://github.com/erocarrera/pefile) One thing special about that library is the ordlookup folder. It looks ...
4
votes
1answer
231 views

Wierd names in import table

I'm trying to do a static analysis of a PE file to see what it does. While doing so, I stumbled upon some really wierd function names in my objdump DLL Name: msvcrt.dll vma: Hint/Ord Member-Name ...
3
votes
2answers
7k views

Mapping Android resource IDs to resource string

I'm trying to reverse engineer an Android app. I've tried using several decompilers, and while I'm getting java source codes to varying levels of accuracy, I'm not able to convert the resource IDs to ...
3
votes
1answer
137 views

16 bit Dos string concat function

I just got into reversing, i'm a bit puzzled by a part of the following code. I know what its doing, from a technical aspect, but i don't really understand why its doing it. This is the part I have a ...
1
vote
2answers
156 views

Figure out whether a function has return value of not?

I am doing binary analysis on x86-64bit ELF binaries. All the binaries are compiled from C language. Basically, for a given function, I would like to figure out whether this function has a return ...
9
votes
5answers
3k views

Lifting up binaries of any arch into an intermediate language for static analysis

Background As the title is self-explanatory, I would like to translate binaries of any architecture (e.g. x86, ARM, ARM Thumb) to an intermediate language in order to apply arch-independent static ...
3
votes
1answer
135 views

Exploitability of Stack-based Buffer Overflows on functions ending with fclose()

I have been discussing the effectiveness of GNU libc's fclose() function to thwart successful exploitation of trivial vulnerabilities due to segmentation fault when called without a valid pointer to a ...
3
votes
1answer
296 views

Can a basic-block have more than 2 outgoing edges?

For the ease of analysis (i.e., static analysis), I am planning to convert a control-flow graph, of a function, into a spanning tree by removing the backward edges. I wonder whether this spanning tree ...
1
vote
1answer
112 views

Linking entire library statically at exact same location [closed]

I wrote a small driver program utilizing static version of GNU gmp library. I observed that the library itself is 1.2 MB while the driver executable is of 237 KB. This has led me to believe that the ...
4
votes
2answers
499 views

Locating Memory Allocation Functions from Static Analysis

I'm currently working on reversing a firmware binary for an embedded device. This device is using an uncommon architecture: it is a modified Harvard architecture, running on a TMS320C55x chipset with ...
3
votes
3answers
447 views

Tools for static function discovery

In the case of static function discovery based on disassembled code, IDA is the best tool I know. What open source tools or frameworks are also able to perform function detection/analysis? I know ...
0
votes
1answer
3k views

Red addresses in IDA Pro

I know that red addresses means, that code do not recognize as a function in IDA, because that code never get called. But I have found a piece of code that is marked red, but when debugging, I saw ...
2
votes
1answer
464 views

Visual studio memory allocation reverse engineering

I compile this code with Visual studio 2010 compiler: #include "stdafx.h" #include <iostream> int main() { int *p; p = new int(255); delete []p; } The disassembly of it, is different ...
3
votes
1answer
520 views

Computing subtracted stack space for a function manually

Lets assume this function frame : How to calculate and check if subtracted stack space by line 3 is 58h ?: sub esp, 58h And this is the code, the compiler is also Dev C++: #include <stdio.h> ...
2
votes
1answer
540 views

How do I find a collision for a simple hash algorithm

I have the following hash algorithm: unsigned long specialNum=0x4E67C6A7; unsigned int ch; char inputVal[]=" AAPB2GXG"; for(int i=0;i<strlen(inputVal);i++) ...
1
vote
1answer
315 views

finding a checksum function using static analysis (IDA)

I have an dll that is loaded into a 64 bit process, it performs two check sums (at least) one to keep up to date (it receives a 13 character long string from the net which I'm fairly certain is an in ...
3
votes
2answers
2k views

IDA Pro: Side effects or disadvantages of “Create function”

Some instructions in a binary do not belong to a function, or, IDA does not manage to recover one. See for example the red addresses in the below screen shot. Yet, one can right-click such 'function-...
2
votes
2answers
1k views

Generating call graph for assembly instructions

I'm writing a tool and I need to generate the callgraph for assembly instructions. But I do not know how to exactly generate call graph from assembly instruction. Do you have any idea? To clarify, I ...