Questions tagged [static-analysis]

Static analysis is the analysis code without actually executing it. This is in contrast to dynamic analysis which executes the code.

Filter by
Sorted by
Tagged with
1
vote
1answer
521 views

re-construction of c code: movsx with test instruction

I just started learning about reconstructing C code from assembler instructions. I have the following piece of assembler code: mov eax dword ptr [ebp+8] add eax, dword ptr[ebp-4] movsx ecx, byte ptr ...
1
vote
2answers
187 views

Figure out whether a function has return value of not?

I am doing binary analysis on x86-64bit ELF binaries. All the binaries are compiled from C language. Basically, for a given function, I would like to figure out whether this function has a return ...
1
vote
2answers
47 views

Lifting exported function instructions in PE files

I am trying to automate analysis of instructions within exported functions for a .DLL and need to be able to lift the first few instructions for the entry point of each exported function statically ...
1
vote
1answer
192 views

Dynamic analysis (Frida) reveals instance of a class that doesn't exist in the source code (dex2jar)

I have been diving into an apk's source code, doing both static analysis with Jadx (same as dex2jar) and dynamic analysis with Frida. I am trying to replicate the method that signs HTTP requests "...
1
vote
1answer
104 views

Memory map in AVR Harvard architecture

In this video https://youtu.be/D0VKuZuuvW8?t=259 . You can see that flash address is beteen 0x0 to 0x3fff. and Data memory ( Io register and SRAM ) is between 0x0 to 0x8ff . So in the video he ask ...
1
vote
1answer
96 views

Finding a mathematical calculation which uses Pi within binary

Given a large (~14MB) binary compiled for a X86 64-bit system, what would be the basic steps to go through in order to find the usage of Pi (π) for calculation of a certain parameter (flag)? I'm ...
1
vote
1answer
356 views

Identify function in cpp static binary

When I open cpp static binary, how can identify known functions like fopen/ioctl/printf? They have been compiled statically into the binary. I dont know the compiler of this binary .
1
vote
1answer
1k views

How to find the starting address of main function when the binary is stripped and _start doesn't push the absolute address value of main?

So let's say the ELF binary is stripped - meaning no symbol table - and the _start function doesn't push the address of main before calling __libc_start_main. This happened in a binary when compiled ...
1
vote
1answer
1k views

Radare's `aaaa` and -AA what does it do, exactly?

When I run aaa, Radare tells me, [x] Use -AA or aaaa to perform additional experimental analysis. But what does aaaa do? It's not documented under aa? nor aaa? nor [0x000028e0]> aaa? Usage: See ...
1
vote
1answer
274 views

Learning fine grained analysis in Radare with `a`?

The Radare community generally seems to look down upon simply running AAA or AAAA claiming that you need to instead learn the fine grained analysis and what they do. However, there seems to be no ...
1
vote
1answer
104 views

Windbg's “dt” equivalent in IDA?

I wanted to ask whether there is a simple way to see an object's structure (like windbg's "dt" command equivalent)? Assuming of course I have the pdb file. Thank you :)
1
vote
1answer
94 views

IDA search results not showing up in a separate window

I'm just learning to use IDA and according to the book, when using Search function (Search>text..., for example) I should see a window with the found results, like this: However, when the search ...
1
vote
1answer
153 views

What does this sequence of numbers mean?

so i'm reversing a file format of game. As far as i can understand the file i'm trying to reverse contains compressed textures. I'm already able to locate the textures and decompress them, but i'm not ...
1
vote
2answers
180 views

Obfuscation by changing the order of a malware behaviour

I know that there are some obfuscation techniques which can lead to slowing or even failing the detection of malware when static analysis is used. However, is there a similar technique that changes ...
1
vote
1answer
901 views

Function dependencies in static libraries

I read in another SO thread: With static libraries, the unit of copying is the object file in the library. In other words, if two programs call a function from a certain object file, both ...
1
vote
1answer
388 views

finding a checksum function using static analysis (IDA)

I have an dll that is loaded into a 64 bit process, it performs two check sums (at least) one to keep up to date (it receives a 13 character long string from the net which I'm fairly certain is an in ...
1
vote
1answer
364 views

How do I find non-exported symbols of a binary?

You can use nm(liux/mac) to find exported and imported functions/symbols, is it possible to find the non-exported symbols of a binary in a similar way? Are there command line tools to assist with this?...
1
vote
1answer
197 views

Find all syscall in statically Arm Binary

What is the easy and fast way to find all syscall in statically Arm binary ? Is there any Ida plugin that do that?
1
vote
1answer
185 views

How to extract static API sequences of a PE file?

How does one extract the static API sequences of a PE file? I don't mean the imports listed in the imports segment. I am currently using different RE tools like Ghidra, IDA Pro, and Binary Ninja. ...
1
vote
2answers
185 views

Trouble when reverse engineering a industrial robot software in order to get some values

For the bit of background, I'm a robotic engineer. Robotics manufactures hide some parameters of their robots in order to avoid their competition. Now, I need these data to compute the dynamics model ...
1
vote
1answer
169 views

How can I know what the executable is missing to run?

I have extracted a presence of MZ file from memory which happen to be available in VirusTotal ( might be a malicious executable). However, I could not run the program. It seems to have some missing ...
1
vote
1answer
253 views

IDA - large jump table, missing cases in analysis

I have come across the following jump table with a large amount of cases (160+). There seems to be cases missing from IDAs analysis though. For example it skips from cases 22 -> 38 -> 91, and I can ...
1
vote
1answer
184 views

Reverse Engineering Flat Data File

I'm writing a piece of software that will take positional data from a piece of software called Pyware and put it into a GUI so I can visualize the coordinates and assign each coordinate a color. ...
1
vote
1answer
169 views

Which RE tool is missing?

I am analyzing a malware at the moment which scans for a lot of filenames and ClassNames to recognize if it is under supervision or not. My problem is, that all the filenames and ClassNames are ...
1
vote
1answer
1k views

Elf file format finding .got and .got.plt segments

I'm writing ELF parser and simple disassembler x86. Having code like this .text:000B5A2A call 0000B470 ;e.g. _glXSwapBuffers ... ... got.plt:0000B470 jmp dword ptr [ebx+240h] ;jump to ....
1
vote
1answer
1k views

Dose PE Explorer unpack upx executables?

I was analysing Lab01-02.exe from Practical Malware Analysis book, the exe is packed with upx, since it showed UPX0, 1, 2 in the header section when analyzed with PEview, but when I open the same exe ...
1
vote
1answer
265 views

IDA Hex-Rays Generating Redundant Code

Hex-Rays generated C code is adding a lot of redundancy code, and I cannot figure out why and it really frustrates me to remove them manually on my reverse engineering process. if ( v1 ) { v15....
1
vote
1answer
2k views

Resolving DLL function names using ordinals

I am trying to figure out how to get the imports of a PE using the PEfile python project (https://github.com/erocarrera/pefile) One thing special about that library is the ordlookup folder. It looks ...
1
vote
2answers
760 views

identify packer compression or encryption algorithm

I do have an executable packed file. I want to detect compression or encryption algorithm dynamic and static ways separatly; of course without signature base way. How can I detect compression or ...
1
vote
1answer
188 views

Is there anyway I can iterate all the C-level statements in IDA-Pro?

I am trying to iterate all the C statement (could be very coarse-grained, it's fine) in IDA-Pro recovered assembly program. Suppose I only consider these statements: State :: = | if-else cond; |...
1
vote
0answers
82 views

CRC16 Reverse in C166 Arch

Before that I asked about piece of code that used in this algorithm (here). Now I have a bit problem with the rest of algorithm. So I have to describe this with detail. Sorry if i vast your time for ...
1
vote
0answers
36 views

Strange memory allocation behaviour

I'm currently working on a modding library for a particular game, and I have come across a part of the menu system that I can't figure out the purpose of. The expression in question is this: unsigned ...
1
vote
0answers
42 views

Statically injecting translated NASM assembly into existing ELF binary

I'm trying to statically patching ELF binaries in order to incorporate code that can help provide run-time protection. In an effort to save time writing and debugging assembly, I took the following no-...
1
vote
0answers
60 views

Immediate offset LDR in presumed malloc function looks wrong in static analysis

I am attempting to disassemble a ROM image for a BCM4366C [1] after reading a blog post where researchers reversed some other Broadcom chips [2] . I have analyzed the ROM image in Ghidra and I have ...
1
vote
0answers
117 views

Removing/bypassing a BIOS whitelist

I am trying to bypass or erase the BIOS whitelist on my Thinkpad T440p. So far I've used flashrom and a soic8 clip to dump the bios to a bios.img file made another dump and compared with diff bios....
1
vote
0answers
62 views

ARM chip gpio/ identification from firmware code

Device: i was able to recover bricked Chinese IOT a Sous Vide cooker. Replaced damaged capacitor. it works. it has ARM soc/mcu/processor WI-FI (broadcom) LCD touch screen + 16bit STM mcu. EEPROM ...
1
vote
0answers
14 views

Locating Exit/Abort Functions from Static Analysis

Similar to this question, I'm interested in locating exit and abort style functions in a firmware - any function call that in fact terminates the execution, by statically analyzing the firmware. My ...
1
vote
0answers
39 views

IDA Pro SP tracking

I am reversing a BIOS and its code extensively uses SP register for 16-bit return addresses (and also things like "bswap ESP" to obtain a "two-level-deep" stack, and rarely "mov mm7, esp" to obtain a "...
1
vote
0answers
61 views

static core dump analysis

I got a coredump from an unknow binary. I want to retrieve as many information as possible (memory, register, contexte..) Most of the answers available on the web speak about coredump analysis using ...
1
vote
1answer
222 views

How to restore IAT?

I have the start address and the end address of the IAT now im trying to restore the table/folder of it. the start address is: E7C000 thx for helping
1
vote
0answers
60 views

Parse / statically analyzing .NET binaries using python

Which libraries do you use to parse and statically analyze .NET binaries? Is there a python module, or do I have to use a .NET library such as dnlib? Does it make sense to write a python wrapper for ...
1
vote
0answers
148 views

Reconstructing struct/union-based IPC protocol wire format

I'm embarking on my first reverse-engineering adventure. I think I've picked a rather dense piece of steak to start out with. I have three C programs which communicate together using an unknown IPC ...
1
vote
1answer
422 views

pyelftools relocation section symbols

I have been trying to get into reverse engineering as of late and after playing with Radare2 I realized I was playing with a lot of things without really understanding what I was doing. In an effort ...
1
vote
0answers
780 views

Finding function call (with arguments) in ELF file

I have two kinds of ELF files, built from C++. .so files: ELF 64-bit LSB shared object, x86-64, version 1 (GNU/Linux), dynamically linked, BuildID[sha1]=5e751e769912aef28bc63b888e5e4904b867a180, ...
1
vote
0answers
225 views

Saving IDA Graph to PDF format?

I want to save flow/call graph of IDA into a pdf format so that I could view it in my android. How can I do that? I know IDA can generate a flow chart (gdl file) and call chart (gdl file). But my ...
1
vote
0answers
72 views

Where can I get a good description about windows build-in exe programs like wupdmgr.exe?

I was checking the Strings for Lab01-04.exe from Practical Malware Analysis and I found wupdmgr.exe and I face this every time I search for an exe. Is there any "msdn" alike repository but for exe ...
1
vote
1answer
1k views

How to search sequence of API call using IDA Pro?

I want to search the sequence of API call using IDA Pro. How to search the API call node execution and what is the next API call node execution followed using IDA Pro.
1
vote
1answer
118 views

Linking entire library statically at exact same location [closed]

I wrote a small driver program utilizing static version of GNU gmp library. I observed that the library itself is 1.2 MB while the driver executable is of 237 KB. This has led me to believe that the ...
1
vote
0answers
469 views

Static binary instrumentation tools for android .so libraries?

I'm trying to statically inject code into an android app. The best way would be to use APKStudio and the like, but there are very harsh restrictions on the device and the app itself, so that apk ...
0
votes
1answer
9k views

Reverse engineering a golang binary file

I compiled docker by myself with some modifications. I would like to perform some static analysis to the binary. Mostly to see which parts of the code take more memory, etc. It's on linux (elf). Any ...