6
votes
Accepted
Are there any static binary rewriting tools？
I just extracted the following list during my research of this paper:
"Reassembleable Disassembling" Shuai Wang, Pei Wang, and Dinghao Wu,
The Pennsylvania State University
The following list ...
- 1,257
5
votes
Trace Method Calls in .NET/C# Binary
that instrumentation is not easily possible because of JIT compilation of IL instructions.
Well it's actually the opposite. Tracing methods is quite easy - it would be difficult if we would like to ...
- 4,912
3
votes
Trace Method Calls in .NET/C# Binary
You can use de4dot (https://github.com/0xd4d/de4dot) to deobfuscate the binary. Static analysis of dotnet binaries can be done easily by using de4dot and then using ILSpy to create a visual studio ...
- 31
3
votes
Running just one function from an compiled executable or shared object?
I think you are looking for ESIL which allow you to emulate code
Specifically aei to initialize the VM and aeip to set the pc to curseek. You can list registers using aer and set them with aer eax=1
...
- 311
3
votes
Accepted
Intel PIN: InsertPredicatedCall and INS_InsertCall
You are correct, we should use INS_InsertPredicatedCall instead of INS_InsertCall in your case. It is quite intuitive to distinguish one from the other, consider the following code
cond:
xor eax, ...
- 1,410
3
votes
Is it possible to programmatically determine if a crash resulted from a buffer overflow?
it is not clear if you are using windbg and you have a bunch of .dmp files that you want to auto analyze for access-violation if that is the case you could check this out
original contents of ...
- 16.3k
3
votes
Configure and execute Intel's PIN Tool
The fastest and less cumbersome way I know is to make a copy of MyPinTool directory (under <pin dir>\source\tools\ and overwrite the file MyPinTool.cpp with your own code.
Open the MyPinTool....
- 1,041
3
votes
Accepted
Binary Instrumentation of malware binaries?
Yes, your Pintool written in C/C++ works fine for binaries (of x86 or x86-64 instruction set) generated from compilers of other languages. You can see this quotes in the file README of any Pin ...
- 1,410
2
votes
Saving program execution state for fuzzing
CreateToolhelp32Snapshot() would help for creating a snapshot of program state, especially fuzzing a la this paper
Also, Peter Van Eeckhoutte covered what you're attempting to do in (in-memory ...
- 368
2
votes
Running just one function from an compiled executable or shared object?
As you correctly mentioned, this is a pseudo C code which output a C-like code. This code can't be compiled since it's not a valid C code. This output can be shown using the pdc command.
radare2 ...
- 8,919
1
vote
In Pintool, How to find the name of an routine's caller?
In instruction instrumentation function, you can check if the instruction is indeed a call instruction. Something like -
if (INS_IsCall(ins))
{
if (INS_IsDirectCall(ins))
{
Then ...
- 1,797
1
vote
Dynamic instrumentation tool for injecting assembly
Doing it that way is harder to automate since the tool will need to adjust many local relative addresses (function calls, data access, etc).
It may be technically possible but might depend on ...
- 11.7k
1
vote
Instrument memory accesses of python scripts
Using pin -t <pintool> -- python <python_script.py> is nearly equivalent to compiling your code using Pyinstaller and then running it using pin. Pyinstaller bundles python runtime and your ...
- 1,797
1
vote
modern instrumentation for reversing and researching
Some may favor miasm over other frameworks (see for instance the Advanced Binary Deobfuscation material). Examples:
Analyzing Shellcodes with Miasm for Fun and Profit
ZeusVM analysis
The Qiling ...
- 7,078
1
vote
Detect interesting testcases
If you want to discover new test cases (or check that a test case is valuable) on a binary, the good way to go is to use tools such as KLEE (see this small tutorial).
The point is too use symbolic ...
- 18.9k
1
vote
Accepted
Intel PIN (TracerPIN): adding modification of registers
What worked for me was passing a reference to the register to my changeReg() function with IARG_REG_REFERENCE, then changing the value the reference points to.
- 351
1
vote
Running just one function from an compiled executable or shared object?
A few of other approaches could be:
Using IDA's AppCall functionality. It isn't all too known a feature (and it should be!) but IDA makes an effort letting you use functions inside the binary in ...
- 11.7k
1
vote
Accepted
How to use Frida on a Java application ? (non Android application)
To my best knowledge, Frida has no support for non-android java applications.
For desktop java applications you are better of using Java agents or the lower level JVM-TI interface. There's also the ...
- 6,050
1
vote
Accepted
Dumpout Process Memory Layout During Loading Time
I think that one option could be to use ptrace, for example you can use _dl_open() instead of LD_PRELOAD. Look at this example:
http://www.ars-informatica.com/Root/Code/2010_04_18/LinuxPTrace.aspx
...
- 309
1
vote
How to perform memory address translation on x86 instructions?
If you have control over the original memory, and performance is not a concern, you can install an exception handler, and then mark the entire original memory region as "not accessible". For each ...
- 4,701
1
vote
Configure and execute Intel's PIN Tool
Carlos's answer is more of a workaround, but it's so much spot on. Getting all the right knobs right is an insane job. And even more so with version 3 that switched away from whatever native runtime ...
- 115
1
vote
Configure and execute Intel's PIN Tool
I was able to find a blog which helped me configure Visual Studio 10 to develop my own tools. Here is the link to blog . The steps mentioned are generalized. But one thing I observed was that few ...
- 151
1
vote
Forcing a call to an object instance method
I was also struggling with this, until I realized that if the function uses a custom calling convention. args[n] assumes the default calling convention. For custom calling conventions, in this case ...
- 11
Only top scored, non community-wiki answers of a minimum length are eligible