Questions tagged [static-analysis]

Static analysis is the analysis code without actually executing it. This is in contrast to dynamic analysis which executes the code.

Filter by
Sorted by
Tagged with
0
votes
1answer
279 views

Obfuscated VBE malware script analysis

Some actions of this script are clear e.g. the section that adds firewall rules, others not so much On Error Resume Next F27 F10 A0 DBCF Sub F27() Dim E13C563AFCB34, C0009B48F34B, C8, ...
0
votes
2answers
3k views

How to unpack and decrypt malware? [duplicate]

Recently I have been working on reverse engineering of binary samples and executables of known malware. Most of them have been packed or encrypted. And to reach the actual data or part of the program ...
0
votes
1answer
56 views

How to simplify a function “calling itself's reference”

I encounter often a function calling itself (in the pseudo code) such as: result = (**(__int64 (__fastcall ***)(volatile signed __int32 *))lambda)(lambda); Since the disassembly is call qword ptr [...
0
votes
1answer
88 views

ida identifies library function as regular function

I'm trying to find libc symbols in some Windows 32-bit application. For some reason, Ida autoanalysis didn't recognized code that comes from libc as "library function", but as a "regular function". ...
0
votes
2answers
769 views

How to get better in re?

I'm a junior security researcher, and I'm interested in improving my ability in RE. I am a programmer at Assembly and C (and python and a few more high level lang). I learned and know how to use ...
0
votes
1answer
249 views

What is the relationship between the Windows API and the C run time library? [closed]

I have two reports of static and dynamic malware analysis. There are some APIs of MSVCRT's dll in my static report, which are missing in the dynamic report. (such as _p_commode, _setusermatherr, etc.) ...
0
votes
1answer
4k views

Red addresses in IDA Pro

I know that red addresses means, that code do not recognize as a function in IDA, because that code never get called. But I have found a piece of code that is marked red, but when debugging, I saw ...
0
votes
1answer
59 views

Why might nm find a few undefined symbols that I can't see with xxd?

I'm cross-comparing a few approaches to testing for binaries that import a symbol and I noticed a YARA rule not finding one in sudo that nm + grep could find. I looked at it in xxd to figure out why, ...
0
votes
1answer
72 views

Static Binary in Windows

I am learning more about binary exploitation on windows. But I saw while revering a binary that you can create static binaries in windows too just like in Linux. It was really ugly. if I would be on ...
0
votes
1answer
36 views

What is this line and how to remove it

I tried to unpack packed_dll, when the unpack stage done, i dumped unpacked_dll out and start to reverse. I pretty sure this is continuously function of that dll but this line show up. So what is this ...
0
votes
1answer
698 views

Find functions signatures in Ida?

I didn't understand the subject of find function in Ida via signature. If I understand well that way helps to recognize libraries functions in static binary(in dynamic binary I can see the functions ...
0
votes
1answer
197 views

me_cleaner and fwupd, or manipulating UEFI .cab files

I'd like to extract a plain dump of the UEFI firmware of my laptop (1:1 copy of the flash content, often called .bin or .rom files) from the .cap file, so that I can modify it slightly with me_cleaner....
0
votes
2answers
181 views

Identifying a very weak hash algorithm

I'm reverse-engineering a string translation file format for a particular game. It's ultimately just an ID-to-string map, where the IDs are four-byte integers. There are 1935 IDs in total; you can see ...
0
votes
1answer
71 views

Difference between \n, \0, \x00 and data from /dev/zero when performing a buffer overflow?

I am working with a binary that involves a buffer overflow on two contiguous memory blocks allocated with malloc. The binary filles up the first buffer with whatever the user inputs and hardcodes the ...
0
votes
2answers
126 views

Is manually converting/decompiling x86 source code to C/C++/etc… considered reverse engineering?

I have the source code of an old program written in 32-bit x86 assembler that I am working on manually rewriting in C. The first time someone asked me about this project I told them I was 'reverse ...
0
votes
1answer
66 views

PE file export functions of packed file

I am new to reverse engineering and I am learning about packed files. I saw that most of the time I can recognize a packed file with a little number of import functions in PE file and not many strings ...
0
votes
1answer
121 views

Detecting libc function with IDA

I have binary than running on Arm , static and striped. I don't know which compiler compiled this binary. How can I identify function like fread sleep printf ioctl
0
votes
1answer
79 views

IDA Change ram and rom without reopen IDA

when I open binary and write ram and rom , I don't know how to change it (and re parse all the binary) without close and open again the binary. Is there any smart way ?
0
votes
1answer
2k views

How do I find the address of a data location at runtime?

I'm using ghidra and cheat engine to reverse engineer a game's function. In ghidra's decompiler this function references two locations known as _DAT_XXX. I know the addresses of these locations in the ...
0
votes
1answer
212 views

Automatically detecting and carving images from .doc, .docx and spreadsheets

I'm looking for a tool that can extract detect and extract any image format from word documents in both .doc and .docx formats for an automatic document classification use case. It is nice to just ...
0
votes
1answer
69 views

what does BYTES_REVERSED_HI and BYTES_REVERSED_LO in an PE signify

How can these pe attributes be used to identify malware. I was going though a paper link at page 10 he mentioned. "BYTES_REVERSED_HI and BYTES_REVERSED_LO both make ideal candidates as a primary ...
0
votes
1answer
106 views

Reverse engineering Infostealer.Dyre

I'm a newbie to malware analysis and reverse engineering in general. I got hold of a Dyre malware sample from theZoo on GitHub and I've been trying to analyze it. I've put up my analysis report here. ...
0
votes
1answer
953 views

Parsing .rodata (ELF)

IDA pro is able to display the data contained in the read only data section of ELF files, but the section is defined as type SHT_PROGBITS. To my knowledge, we cannot parse sections of this type to ...
0
votes
1answer
191 views

Get driver binary

I am running an application that just after starting, it creates a service (process hacker tool notifies me that driver_app.sys has been created). Indeed, it says that the location of driver_app.sys ...
0
votes
3answers
352 views

Is it possible to programmatically search a disassembly for functions missing bounds checks?

Suppose I was to search a file for dangerous C functions: Assuming that we can perform a dissassembly, and that we cannot perform dynamic analysis is it possible to definitively identify a lack of ...
0
votes
1answer
131 views

What is the relation between binary (executable) instructions and execution instruction [closed]

What I want to know is that is there any similarity or may be difference between a binary instructions and an execution instruction of a binary ? In other world, in area of malware analysis a binary ...
0
votes
0answers
25 views

Why parameters are out side of stack frame ( green) in attached image?

In my assumption, stack frame is between EBP & ESP only. But Stack frame is started from out side of EBP, in the attached image.
0
votes
0answers
26 views

Can you strip a mips64 object file?

-strip doesn’t know what this file is but read elf and objdump recognize it read elf gives entry and all the headers. I’m trying to find main() or the start function. Can I strip the file? Do I need ...
0
votes
0answers
35 views

What is the difference between a file on disk and a file on memory?

Currently, I am learning about the differences between static and dynamic analysis. I have come across this incredible question that has been bugging me: What happens to the file (in memory) when you ...
0
votes
0answers
45 views

Using GDB to find the address of a buffer in a stripped C binary

I am working with a crackmes binary called Simple Overflow. It has two buffers with sizes 0x10 and 0x8, and it uses malloc to allocate two contiguous memory blocks (see <+25> and <+39> on ...
0
votes
1answer
57 views

Is it possible to make a dynamic memory allocated .data segment to static in a file?

Sorry if this is a dumb question I'm new to assembly. Basically I want to modify a function in a .exe file to return with a different data, but my issue is that the memory location of the data segment ...
0
votes
1answer
64 views

How can I find a value in Tricore(TC1766) Arch?

I recently work on Tricore Processor, but I have some problems. With reading memory value. I do not know if I am right or not, but I think a part of flash memory copied to RAM and now in my algorithm ...
0
votes
0answers
48 views

How to use aarch64 call convention to understand an unknown function?

I’m trying to reverse engineer an aarch64 Golang binary which happens to call a symbol, i.e., function named guess_me which is an import. To stop the binary from throwing errors, I write a Hello World!...
0
votes
0answers
85 views

Delphi mt38 CRC (Tricore 1766 Arch)

I want to calculate CRC32 for Delphi mt38 and found the below assembly algorithm and converted it to C. It seems that this algorithm is defined for n = 256 or 1024. I want to calculate CRC32 for n = ...
0
votes
1answer
64 views

Password evaluated from the sum of ASCII letters

After analyzing the code, I have been able to understand and recreate the algorithm used to check if the password the binary takes is correct, but don't know how to solve it (or at least can't think ...
0
votes
0answers
22 views

Symbols for detecting UBSan

I am looking for the symbols that reveal if a specific binary was compiled with UBSan. Unfortunately, Checksec is not able to detect it. So, I have compiled the snippet reported in the official doc. ...
0
votes
0answers
144 views

What are the known techniques used by wrappers and obfuscators to protect against decompiling?

I am NOT looking to make my application 99% safe, nor my goal is to prevent a a determined reverse-engineer to disassemble it, but simply is to protect my source code from lambda user with little ...
0
votes
0answers
39 views

static analysis for identifying backdoors

I am doing a research in identifying backdoors in windows .exe files. Currently I found some methods to detect. 1.String search in .exe 2.find Reffrence .dll and win32 Api calls using import table ...
0
votes
0answers
47 views

Python based static c analysis tools

I want to analyze some open-source C code, and I'm looking for a static analysis python library for C, preferably open-source. Any ideas/suggestions, based on your experience?
0
votes
1answer
109 views

Get function return value

any idea for more ways to get return value? (no hooks, no hw/memory breakpoints, no call functions) thx :) tried to find dword maybe that hold the function return, didn't found. I'm trying to create ...
0
votes
1answer
85 views

Can relative offsets in instructions like call and jmp change after recompiling the same code, or running it in another computer?

So let's say we want to use some instructions as signature for a malware, and it includes some call instructions or jmp instructions. Now, as far as I have seen, they always contain relative offsets ...
-1
votes
1answer
631 views

How can I statically unpack a file packed with an unknown packer without executing it?

I want to implement a generic, static unpacker that can statically unpack files that have been packed with unknown packers. In fact, I want it to be able to unpack packers which I just think of. ...
-1
votes
1answer
121 views

How can I analyze this code? [closed]

I wanted to analyse the code for some functionality. in my understanding the code contains a logic handling intents with extras. I want to know how these Works! and also how can I pass extras using ...
-1
votes
1answer
122 views

Understanding what is represented by function pointers to a block of hex

I'm working on a disassembly project for my class where I'm trying to bypass a license check, but when I throw the executable into Binary Ninja this is what I see: And when I look at those pointers, ...
-1
votes
1answer
112 views

How to find who use these strings?

When i see function like this, im getting confused, because all the strings i need in this function, but how can i find which functions which this strings? how can i know the address of the function ...
-2
votes
1answer
92 views

Need help in understanding the code of a “Malicious” file [closed]

I'm testing a malware sample : hxxps://www.virustotal.com/en/file/55f4cc0f9258efc270aa5e6a3b7acde29962fe64b40c2eb36ef08a7a1369a5bd/analysis/ This is a malicious executable file. When executed in ...
-2
votes
1answer
84 views

Malware static rules? [closed]

Is there any sites to get static rules to detect malware files? static behavior rules for detecting malware files. Thanks in advance.
-3
votes
1answer
224 views

The C166 family code meaning

What the meaning of this code with an explanation? sub_37C2: mov r5, r4 shr r5, #14 shl r5, #1 mov r5, [r5+0FE00h] ; DPP0 bmov r4.14, r5.0 bmov r4.15, r5.1 shr r5, #2 rets ; ...

1 2 3
4