Skip to main content
6 votes
Accepted

Are there any static binary rewriting tools?

I just extracted the following list during my research of this paper: "Reassembleable Disassembling" Shuai Wang, Pei Wang, and Dinghao Wu, The Pennsylvania State University The following list ...
knx's user avatar
  • 1,257
5 votes

Trace Method Calls in .NET/C# Binary

that instrumentation is not easily possible because of JIT compilation of IL instructions. Well it's actually the opposite. Tracing methods is quite easy - it would be difficult if we would like to ...
Paweł Łukasik's user avatar
3 votes

Trace Method Calls in .NET/C# Binary

You can use de4dot (https://github.com/0xd4d/de4dot) to deobfuscate the binary. Static analysis of dotnet binaries can be done easily by using de4dot and then using ILSpy to create a visual studio ...
oridamari's user avatar
3 votes
Accepted

Intel PIN: InsertPredicatedCall and INS_InsertCall

You are correct, we should use INS_InsertPredicatedCall instead of INS_InsertCall in your case. It is quite intuitive to distinguish one from the other, consider the following code cond: xor eax, ...
Ta Thanh Dinh's user avatar
3 votes

Running just one function from an compiled executable or shared object?

I think you are looking for ESIL which allow you to emulate code Specifically aei to initialize the VM and aeip to set the pc to curseek. You can list registers using aer and set them with aer eax=1 ...
Fabian Mendez's user avatar
2 votes

Running just one function from an compiled executable or shared object?

As you correctly mentioned, this is a pseudo C code which output a C-like code. This code can't be compiled since it's not a valid C code. This output can be shown using the pdc command. radare2 ...
Megabeets's user avatar
  • 8,999
1 vote

In Pintool, How to find the name of an routine's caller?

In instruction instrumentation function, you can check if the instruction is indeed a call instruction. Something like - if (INS_IsCall(ins)) { if (INS_IsDirectCall(ins)) { Then ...
R4444's user avatar
  • 1,807
1 vote

Dynamic instrumentation tool for injecting assembly

Doing it that way is harder to automate since the tool will need to adjust many local relative addresses (function calls, data access, etc). It may be technically possible but might depend on ...
NirIzr's user avatar
  • 11.8k
1 vote

Instrument memory accesses of python scripts

Using pin -t <pintool> -- python <python_script.py> is nearly equivalent to compiling your code using Pyinstaller and then running it using pin. Pyinstaller bundles python runtime and your ...
R4444's user avatar
  • 1,807
1 vote

modern instrumentation for reversing and researching

Some may favor miasm over other frameworks (see for instance the Advanced Binary Deobfuscation material). Examples: Analyzing Shellcodes with Miasm for Fun and Profit ZeusVM analysis The Qiling ...
julian's user avatar
  • 7,158
1 vote

Detect interesting testcases

If you want to discover new test cases (or check that a test case is valuable) on a binary, the good way to go is to use tools such as KLEE (see this small tutorial). The point is too use symbolic ...
perror's user avatar
  • 19.1k
1 vote
Accepted

Intel PIN (TracerPIN): adding modification of registers

What worked for me was passing a reference to the register to my changeReg() function with IARG_REG_REFERENCE, then changing the value the reference points to.
manduca's user avatar
  • 351
1 vote

Running just one function from an compiled executable or shared object?

A few of other approaches could be: Using IDA's AppCall functionality. It isn't all too known a feature (and it should be!) but IDA makes an effort letting you use functions inside the binary in ...
NirIzr's user avatar
  • 11.8k
1 vote
Accepted

How to use Frida on a Java application ? (non Android application)

To my best knowledge, Frida has no support for non-android java applications. For desktop java applications you are better of using Java agents or the lower level JVM-TI interface. There's also the ...
0xec's user avatar
  • 6,090
1 vote
Accepted

Dumpout Process Memory Layout During Loading Time

I think that one option could be to use ptrace, for example you can use _dl_open() instead of LD_PRELOAD. Look at this example: http://www.ars-informatica.com/Root/Code/2010_04_18/LinuxPTrace.aspx ...
invictus85's user avatar
1 vote

How to perform memory address translation on x86 instructions?

If you have control over the original memory, and performance is not a concern, you can install an exception handler, and then mark the entire original memory region as "not accessible". For each ...
peter ferrie's user avatar
  • 4,709
1 vote

Configure and execute Intel's PIN Tool

Carlos's answer is more of a workaround, but it's so much spot on. Getting all the right knobs right is an insane job. And even more so with version 3 that switched away from whatever native runtime ...
mirh's user avatar
  • 117
1 vote

Forcing a call to an object instance method

I was also struggling with this, until I realized that if the function uses a custom calling convention. args[n] assumes the default calling convention. For custom calling conventions, in this case ...
Jossec101's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible