Questions tagged [static-analysis]

Static analysis is the analysis code without actually executing it. This is in contrast to [tag:dynamic-analysis] which executes the code.

Filter by
Sorted by
Tagged with
1
vote
2answers
307 views

How to find compressed or encrypted parts in a packed executable?

I want to analyze an executable that went through a packer to look for the parts that have been compressed or encrypted. Of course, it also means that I want to find the code for the decompression or ...
1
vote
2answers
605 views

identify packer compression or encryption algorithm

I do have an executable packed file. I want to detect compression or encryption algorithm dynamic and static ways separatly; of course without signature base way. How can I detect compression or ...
2
votes
1answer
6k views

Searching for a sequence of instructions in IDA Pro

How can I search for a sequence of instructions in IDA Pro? I did manage to search for a single instruction using text search string li.*r4.*-1 (for instruction li r4, -1), but I failed to match ...
5
votes
1answer
3k views

How to create a IDA FLIRT signature for a PPC library?

I'd like to create a IDA FLIRT signature for the following PPC uClibc library: libuClibc-0.9.15.so: ELF 32-bit MSB shared object, PowerPC or cisco 4500, version 1 (SYSV), dynamically linked, for GNU/...
10
votes
2answers
2k views

Protect data stored in binary

Let's say I've some function(i.e. hash function), that generates value from input seed and some precomputed hash values, that are stored somewhere in binary. What are the possible approaches for: ...
1
vote
1answer
167 views

Is there anyway I can iterate all the C-level statements in IDA-Pro?

I am trying to iterate all the C statement (could be very coarse-grained, it's fine) in IDA-Pro recovered assembly program. Suppose I only consider these statements: State :: = | if-else cond; |...
1
vote
1answer
239 views

Where can I learn about code instrumentation?

Currently I am learning about profiling parallel programs. All the profilers heavily use all kinds of instrumentations but this topic is not well explained. Do you know any good sources from which I ...
3
votes
2answers
2k views

Reverse engineering UEFI CAP files

I'm looking to identify code changes in the latest UEFI release for my motherboard, to verify whether the changes include mitigations for the row hammer vulnerability. I'm specifically looking at the ...
-1
votes
1answer
566 views

How can I statically unpack a file packed with an unknown packer without executing it?

I want to implement a generic, static unpacker that can statically unpack files that have been packed with unknown packers. In fact, I want it to be able to unpack packers which I just think of. ...
0
votes
3answers
257 views

Is it possible to programmatically search a disassembly for functions missing bounds checks?

Suppose I was to search a file for dangerous C functions: Assuming that we can perform a dissassembly, and that we cannot perform dynamic analysis is it possible to definitively identify a lack of ...
1
vote
0answers
430 views

Static binary instrumentation tools for android .so libraries?

I'm trying to statically inject code into an android app. The best way would be to use APKStudio and the like, but there are very harsh restrictions on the device and the app itself, so that apk ...
4
votes
1answer
987 views

What is the benefit or reason of using a static disassembler over a dynamic disassembler in terms of malware analysis?

I know that Dynamic program analysis is the analysis of computer software that is performed by executing programs on a real or virtual processor. while Static program analysis is the ...
1
vote
1answer
341 views

How do I find non-exported symbols of a binary?

You can use nm(liux/mac) to find exported and imported functions/symbols, is it possible to find the non-exported symbols of a binary in a similar way? Are there command line tools to assist with this?...
0
votes
1answer
126 views

What is the relation between binary (executable) instructions and execution instruction [closed]

What I want to know is that is there any similarity or may be difference between a binary instructions and an execution instruction of a binary ? In other world, in area of malware analysis a binary ...
6
votes
1answer
2k views

Reverse-engineering a tough-to-crack video game save-file checksum

Been trying to figure this one out for a while now, and would be eternally grateful for anyone with more experience in checksum algorithms lending a hand. I've been trying to alter save files for an ...
2
votes
0answers
368 views

What are the commercial anti reversing techniques? [closed]

I am interested in knowing about what are the latest commercial packages that are out there that deter reverse code engineering. And how do I work around them if necessary ? To be more specific I am ...
1
vote
2answers
527 views

Identifying cryptography algorithm

I have a decryption algorithm that has been pulled from an x86 binary and converted into C# code. The C# works perfectly to decrypt data, but I'd like to identify the algorithm in use, so I could (...
3
votes
1answer
778 views

Is the magic number important

While checking the PE header of DLLs and EXE(s) by PEviewer, I found something called "magic number". After googling "magic number". I found that it is used to determine the file type. My question ...
2
votes
2answers
303 views

Floating point in RE intermediate languages like vine il, bap il, and google/zynamics reil

Are there any technical hurdles to implementing floating point support in re-oriented intermediate languages? I ask because none seem to support it, but give few reasons why. The only comment on the ...
10
votes
2answers
2k views

How to do static analysis to identify pointer from concrete value in assembly?

So basically I am writing some code to do analysis work on disassembled assembly code. I am trapped in this issue for a while, here is an simple example of a disassembled asm code by objdump, ...
2
votes
3answers
4k views

How to figure out which imported function(s) in a virus determine its behaviour?

I want to know how to find the functions which is interesting in malware tools. For example, I have a sample of unknown virus (this sample is lab01-01.exe in the book practical malware analysis lab1-...
5
votes
1answer
3k views

How to identify functions in a stripped binary on x86 32bit?

I am trying to generate a coarse-grained Call Graph based on some assembly code disassembled from binary on x86 32 bit platform. It is very hard to generate a precise Call Graph based on asm code, ...
4
votes
1answer
1k views

Modifying a binary save-data file for a video game with a CRC/Checksum check

I recently overwrote the save game file of a video game that my girlfriend and I had been playing through. After trying to recover the file a few different ways (game didn't erase but overwrote the ...
12
votes
2answers
4k views

Code Coverage - Fuzzing

I have been fuzzing Adobe Reader lately. One of the issues that I face is Code coverage. How do I determine that I have covered all the basic blocks in Adobe Reader and it's libraries. Is there any ...
5
votes
2answers
2k views

Extracting files from google chrome offline installer

I'm trying to extract the files from the Google Chrome offline installer as a reverse engineering exercise So I tried extracting the data inside the installer PE. I tried pestudio which showed me two ...
5
votes
2answers
1k views

How do Android reverse engineering tools extract packages/ package hierarchy present in Android apps?

I have been involved in disassembling Android apps using baksmali and dexpler. Whenever I disassemble an app, I find the packages and package hierarchy (that would have been available in development ...
5
votes
2answers
5k views

How do I view external function calls in dynamically linked ELF binary in linux?

I used the file command in Linux to get information about a binary file. I am also looking for the addresses that these calls are located at. I think I can get this information from GDB or objdump but ...
2
votes
2answers
984 views

Detecting epilogue/prologue of functions [closed]

I'm trying to catch epilogue/prologue of functions in IDApython. Anyone got clue/snippet/algorithm of how should I do this?
2
votes
1answer
369 views

What C construct could generate this assembly sequence?

I have the following disassembly: mov BL, [EAX] inc EAX mov [EDX], BL inc EDX I could see this being the result of: uint8_t foo = bar; ++bar; uint8_t tmp = foo; ++foo; But this assumes C99. Is ...
7
votes
3answers
2k views

Re-engineering to create UML Diagrams from Source and Binary

Are there tools that would create: UML Structural Diagrams from Source Code. UML Behavioral Diagrams from Binary executing on a arm / x86 system. Sources would be in C &/ C++ &/ Python. ...
3
votes
2answers
3k views

backup from ZynOS but, can not be decompressed with LZS

So I have this rom-0 file from Zyxel router P-660HW-T3 v3 and I would like to decompress it, I tried many tools, one of them you can find here the tool using lzs for decompression which works for some ...
2
votes
1answer
1k views

How to find memory addresses which are read from but not written to

Analysing a bootmanager : I'm trying to track all variables which are only read from, and not written to... which will give me the external variables it uses... Is there any such functionality in IDA ...
5
votes
2answers
197 views

Static Analysis - Scope Changes

I am looking for an algorithm or some tips on how to find scope changes when doing static analysis of a decompiled ASM source. I need to know the scope changes for tracking stack usage and reaching ...
10
votes
1answer
758 views

Static analysis data combined with dynamic analysis knowledge

What I'm doing now is placing an awful lot of comments about function variable values, global variable values as comments in my IDA database, which I find ugly after a while and obviously not a best ...
19
votes
5answers
7k views

What tools exist for excavating data structures from flat binary files?

Problem Statement I have a file composed entirely of data structures; I've been trying to find a tool that will enable me to open this file, and declare (perhaps) a type and offset such that i may ...
45
votes
7answers
97k views

How to know in which language/technology program (.exe) is written?

How to understand if exe/dll is written in C++/.Net/Java or in any other language. I tried to use Dependency walker but not able to get required information.
7
votes
1answer
471 views

Loading Windows executable - unexpected data appended at beginning sections after loading in memory

Few days after asking the question I realised I misinterpreted my original findings. It seems .rdata section on file is copied directly to memory, but then first 36 bytes are overwritten by loader ...
4
votes
2answers
937 views

Automatic function naming

I'ld like to know how to bulk rename functions in IDA, based on some condition. Example: Rename all functions to Foo_XYZ where the function accesses a certain static variable, for example : ...
4
votes
1answer
1k views

vtrace / vivisect resources

Where can I find some resources to start learning about vivisect? Blog posts, presentations, PDFs, code examples, anything would be appreciated. I am aware I can read the code but before doing that ...
6
votes
3answers
6k views

IDA Pro function stack frame view

IDA Pro displays certain buffer or padding above (at lower addresses) local variables in stack frame view. For instance: Example 1. The following screen shot of stack frame view shows 12 bytes (...
15
votes
1answer
5k views

IDA EBP variable offset

Let's take a look of how IDA displays address of local variable. For instance: MOV EAX, [EBP + var_4] As we all know as far as local variables go, they are located at lower addresses of EBP. Though,...
9
votes
1answer
1k views

What are the differences between BitBlaze and BAP?

BitBlaze and BAP are two platforms to perform binary analysis. And, if I understand well, they are sharing lots of common features. What are their respective main features and in what do they differ ...
13
votes
4answers
4k views

INT 2D Anti-Forensic Method

Inclusion of an INT 2D instruction appears to be a fairly common anti-debugging tactic used by Windows malware authors. From what I understand, it causes a process to act differently when a debugger ...
19
votes
4answers
6k views

How common are virtualized packers in the wild?

I'm just getting into the RE field, and I learned about virtualized packers (like VMProtect or Themida) in a class about a year ago. How often is malware in the wild really packed with virtualized ...
34
votes
3answers
9k views

How can I reverse optimized integer division/modulo by constant operations?

When compiling a division or modulo by a constant, my compiler (LLVM GCC) generates a series of instructions that I don't understand. When I compile the following minimal examples: int mod7(int x) { ...
8
votes
2answers
257 views

REIL Implementations and Adoption?

Apart from BinNavi (A commercial product from the creators of REIL), I am only aware of one project using REIL, which implements a tiny handful (mov/add/sub/inc/jmp) of the translators to convert x86 ...
24
votes
5answers
3k views

Tools to work cooperatively on the same binary

What's a working tool/methodology to work cooperatively on the same binary (if possible in parallel), that is proven to work? I used various methods long ago to share information with others, but not ...
4
votes
1answer
245 views

What is the scalability of state of the art static binary analysis techniques?

What is the largest program that has been analyzed by a semantics-based static binary analysis? By semantics-based, I mean an analysis that examines the meaning of the program, and does not simply ...
16
votes
4answers
3k views

How to recover variables from an assembly code?

Assuming we have an assembly code, what are the known techniques that could be used to recover the variables used in the original high-level code ? Edit: By recovering variables, I do not mean ...
9
votes
2answers
345 views

What is a correct disassembler?

A disassembler is supposed to produce a human readable representation of the binary program. But the most well known techniques: linear sweep and recursive traversal (see this comment for more) are ...