Questions tagged [static-analysis]

Static analysis is the analysis code without actually executing it. This is in contrast to dynamic analysis which executes the code.

Filter by
Sorted by
Tagged with
1
vote
2answers
178 views

Obfuscation by changing the order of a malware behaviour

I know that there are some obfuscation techniques which can lead to slowing or even failing the detection of malware when static analysis is used. However, is there a similar technique that changes ...
0
votes
1answer
239 views

What is the relationship between the Windows API and the C run time library? [closed]

I have two reports of static and dynamic malware analysis. There are some APIs of MSVCRT's dll in my static report, which are missing in the dynamic report. (such as _p_commode, _setusermatherr, etc.) ...
1
vote
1answer
998 views

How to search sequence of API call using IDA Pro?

I want to search the sequence of API call using IDA Pro. How to search the API call node execution and what is the next API call node execution followed using IDA Pro.
1
vote
1answer
848 views

Function dependencies in static libraries

I read in another SO thread: With static libraries, the unit of copying is the object file in the library. In other words, if two programs call a function from a certain object file, both ...
1
vote
1answer
2k views

Resolving DLL function names using ordinals

I am trying to figure out how to get the imports of a PE using the PEfile python project (https://github.com/erocarrera/pefile) One thing special about that library is the ordlookup folder. It looks ...
4
votes
1answer
243 views

Wierd names in import table

I'm trying to do a static analysis of a PE file to see what it does. While doing so, I stumbled upon some really wierd function names in my objdump DLL Name: msvcrt.dll vma: Hint/Ord Member-Name ...
4
votes
2answers
8k views

Mapping Android resource IDs to resource string

I'm trying to reverse engineer an Android app. I've tried using several decompilers, and while I'm getting java source codes to varying levels of accuracy, I'm not able to convert the resource IDs to ...
3
votes
1answer
142 views

16 bit Dos string concat function

I just got into reversing, i'm a bit puzzled by a part of the following code. I know what its doing, from a technical aspect, but i don't really understand why its doing it. This is the part I have a ...
1
vote
2answers
166 views

Figure out whether a function has return value of not?

I am doing binary analysis on x86-64bit ELF binaries. All the binaries are compiled from C language. Basically, for a given function, I would like to figure out whether this function has a return ...
9
votes
5answers
3k views

Lifting up binaries of any arch into an intermediate language for static analysis

Background As the title is self-explanatory, I would like to translate binaries of any architecture (e.g. x86, ARM, ARM Thumb) to an intermediate language in order to apply arch-independent static ...
3
votes
1answer
165 views

Exploitability of Stack-based Buffer Overflows on functions ending with fclose()

I have been discussing the effectiveness of GNU libc's fclose() function to thwart successful exploitation of trivial vulnerabilities due to segmentation fault when called without a valid pointer to a ...
3
votes
1answer
301 views

Can a basic-block have more than 2 outgoing edges?

For the ease of analysis (i.e., static analysis), I am planning to convert a control-flow graph, of a function, into a spanning tree by removing the backward edges. I wonder whether this spanning tree ...
1
vote
1answer
117 views

Linking entire library statically at exact same location [closed]

I wrote a small driver program utilizing static version of GNU gmp library. I observed that the library itself is 1.2 MB while the driver executable is of 237 KB. This has led me to believe that the ...
4
votes
2answers
590 views

Locating Memory Allocation Functions from Static Analysis

I'm currently working on reversing a firmware binary for an embedded device. This device is using an uncommon architecture: it is a modified Harvard architecture, running on a TMS320C55x chipset with ...
3
votes
3answers
460 views

Tools for static function discovery

In the case of static function discovery based on disassembled code, IDA is the best tool I know. What open source tools or frameworks are also able to perform function detection/analysis? I know ...
0
votes
1answer
3k views

Red addresses in IDA Pro

I know that red addresses means, that code do not recognize as a function in IDA, because that code never get called. But I have found a piece of code that is marked red, but when debugging, I saw ...
2
votes
1answer
493 views

Visual studio memory allocation reverse engineering

I compile this code with Visual studio 2010 compiler: #include "stdafx.h" #include <iostream> int main() { int *p; p = new int(255); delete []p; } The disassembly of it, is different ...
3
votes
1answer
548 views

Computing subtracted stack space for a function manually

Lets assume this function frame : How to calculate and check if subtracted stack space by line 3 is 58h ?: sub esp, 58h And this is the code, the compiler is also Dev C++: #include <stdio.h> ...
2
votes
1answer
577 views

How do I find a collision for a simple hash algorithm

I have the following hash algorithm: unsigned long specialNum=0x4E67C6A7; unsigned int ch; char inputVal[]=" AAPB2GXG"; for(int i=0;i<strlen(inputVal);i++) ...
1
vote
1answer
339 views

finding a checksum function using static analysis (IDA)

I have an dll that is loaded into a 64 bit process, it performs two check sums (at least) one to keep up to date (it receives a 13 character long string from the net which I'm fairly certain is an in ...
3
votes
2answers
2k views

IDA Pro: Side effects or disadvantages of “Create function”

Some instructions in a binary do not belong to a function, or, IDA does not manage to recover one. See for example the red addresses in the below screen shot. Yet, one can right-click such 'function-...
2
votes
2answers
1k views

Generating call graph for assembly instructions

I'm writing a tool and I need to generate the callgraph for assembly instructions. But I do not know how to exactly generate call graph from assembly instruction. Do you have any idea? To clarify, I ...
1
vote
2answers
323 views

How to find compressed or encrypted parts in a packed executable?

I want to analyze an executable that went through a packer to look for the parts that have been compressed or encrypted. Of course, it also means that I want to find the code for the decompression or ...
1
vote
2answers
669 views

identify packer compression or encryption algorithm

I do have an executable packed file. I want to detect compression or encryption algorithm dynamic and static ways separatly; of course without signature base way. How can I detect compression or ...
2
votes
1answer
7k views

Searching for a sequence of instructions in IDA Pro

How can I search for a sequence of instructions in IDA Pro? I did manage to search for a single instruction using text search string li.*r4.*-1 (for instruction li r4, -1), but I failed to match ...
5
votes
1answer
4k views

How to create a IDA FLIRT signature for a PPC library?

I'd like to create a IDA FLIRT signature for the following PPC uClibc library: libuClibc-0.9.15.so: ELF 32-bit MSB shared object, PowerPC or cisco 4500, version 1 (SYSV), dynamically linked, for GNU/...
11
votes
2answers
2k views

Protect data stored in binary

Let's say I've some function(i.e. hash function), that generates value from input seed and some precomputed hash values, that are stored somewhere in binary. What are the possible approaches for: ...
1
vote
1answer
181 views

Is there anyway I can iterate all the C-level statements in IDA-Pro?

I am trying to iterate all the C statement (could be very coarse-grained, it's fine) in IDA-Pro recovered assembly program. Suppose I only consider these statements: State :: = | if-else cond; |...
1
vote
1answer
249 views

Where can I learn about code instrumentation?

Currently I am learning about profiling parallel programs. All the profilers heavily use all kinds of instrumentations but this topic is not well explained. Do you know any good sources from which I ...
3
votes
2answers
2k views

Reverse engineering UEFI CAP files

I'm looking to identify code changes in the latest UEFI release for my motherboard, to verify whether the changes include mitigations for the row hammer vulnerability. I'm specifically looking at the ...
-1
votes
1answer
593 views

How can I statically unpack a file packed with an unknown packer without executing it?

I want to implement a generic, static unpacker that can statically unpack files that have been packed with unknown packers. In fact, I want it to be able to unpack packers which I just think of. ...
0
votes
3answers
291 views

Is it possible to programmatically search a disassembly for functions missing bounds checks?

Suppose I was to search a file for dangerous C functions: Assuming that we can perform a dissassembly, and that we cannot perform dynamic analysis is it possible to definitively identify a lack of ...
1
vote
0answers
441 views

Static binary instrumentation tools for android .so libraries?

I'm trying to statically inject code into an android app. The best way would be to use APKStudio and the like, but there are very harsh restrictions on the device and the app itself, so that apk ...
4
votes
1answer
1k views

What is the benefit or reason of using a static disassembler over a dynamic disassembler in terms of malware analysis?

I know that Dynamic program analysis is the analysis of computer software that is performed by executing programs on a real or virtual processor. while Static program analysis is the ...
1
vote
1answer
351 views

How do I find non-exported symbols of a binary?

You can use nm(liux/mac) to find exported and imported functions/symbols, is it possible to find the non-exported symbols of a binary in a similar way? Are there command line tools to assist with this?...
0
votes
1answer
127 views

What is the relation between binary (executable) instructions and execution instruction [closed]

What I want to know is that is there any similarity or may be difference between a binary instructions and an execution instruction of a binary ? In other world, in area of malware analysis a binary ...
7
votes
1answer
3k views

Reverse-engineering a tough-to-crack video game save-file checksum

Been trying to figure this one out for a while now, and would be eternally grateful for anyone with more experience in checksum algorithms lending a hand. I've been trying to alter save files for an ...
2
votes
0answers
380 views

What are the commercial anti reversing techniques? [closed]

I am interested in knowing about what are the latest commercial packages that are out there that deter reverse code engineering. And how do I work around them if necessary ? To be more specific I am ...
1
vote
2answers
545 views

Identifying cryptography algorithm

I have a decryption algorithm that has been pulled from an x86 binary and converted into C# code. The C# works perfectly to decrypt data, but I'd like to identify the algorithm in use, so I could (...
3
votes
1answer
1k views

Is the magic number important

While checking the PE header of DLLs and EXE(s) by PEviewer, I found something called "magic number". After googling "magic number". I found that it is used to determine the file type. My question ...
2
votes
2answers
307 views

Floating point in RE intermediate languages like vine il, bap il, and google/zynamics reil

Are there any technical hurdles to implementing floating point support in re-oriented intermediate languages? I ask because none seem to support it, but give few reasons why. The only comment on the ...
10
votes
2answers
2k views

How to do static analysis to identify pointer from concrete value in assembly?

So basically I am writing some code to do analysis work on disassembled assembly code. I am trapped in this issue for a while, here is an simple example of a disassembled asm code by objdump, ...
2
votes
3answers
4k views

How to figure out which imported function(s) in a virus determine its behaviour?

I want to know how to find the functions which is interesting in malware tools. For example, I have a sample of unknown virus (this sample is lab01-01.exe in the book practical malware analysis lab1-...
5
votes
2answers
3k views

How to identify functions in a stripped binary on x86 32bit?

I am trying to generate a coarse-grained Call Graph based on some assembly code disassembled from binary on x86 32 bit platform. It is very hard to generate a precise Call Graph based on asm code, ...
4
votes
1answer
1k views

Modifying a binary save-data file for a video game with a CRC/Checksum check

I recently overwrote the save game file of a video game that my girlfriend and I had been playing through. After trying to recover the file a few different ways (game didn't erase but overwrote the ...
15
votes
3answers
5k views

Code Coverage - Fuzzing

I have been fuzzing Adobe Reader lately. One of the issues that I face is Code coverage. How do I determine that I have covered all the basic blocks in Adobe Reader and it's libraries. Is there any ...
5
votes
2answers
3k views

Extracting files from google chrome offline installer

I'm trying to extract the files from the Google Chrome offline installer as a reverse engineering exercise So I tried extracting the data inside the installer PE. I tried pestudio which showed me two ...
5
votes
2answers
1k views

How do Android reverse engineering tools extract packages/ package hierarchy present in Android apps?

I have been involved in disassembling Android apps using baksmali and dexpler. Whenever I disassemble an app, I find the packages and package hierarchy (that would have been available in development ...
6
votes
2answers
6k views

How do I view external function calls in dynamically linked ELF binary in linux?

I used the file command in Linux to get information about a binary file. I am also looking for the addresses that these calls are located at. I think I can get this information from GDB or objdump but ...
2
votes
2answers
1k views

Detecting epilogue/prologue of functions [closed]

I'm trying to catch epilogue/prologue of functions in IDApython. Anyone got clue/snippet/algorithm of how should I do this?