Skip to main content
11 votes

Control flow graph reconstruction projects

Extracting control flow graph in JSON with radare2: $> python import r2pipe r2 = r2pipe.open("/bin/ls") r2.cmd("aaa") # See radare.today/posts/analysis-by-default/ cfg = r2.cmdj("agj") https://...
Maijin's user avatar
  • 880
9 votes
Accepted

Emulating Routers and other Embedded Devices with QEMU

Emulating a complete physical device is always going to be more of an experimental exercise. In this regard you can use firmadyne which aims to emulate Linux based embedded firmware for MIPS and ARM ...
0xec's user avatar
  • 6,090
7 votes
Accepted

Control flow graph reconstruction projects

For now, the most efficient approaches in practice seems to follow the principle of symbolic execution. This technique, originally developed to automatically build-up a set of test cases based on a ...
perror's user avatar
  • 19.1k
7 votes

How can I reverse optimized integer division/modulo by constant operations?

Here's a late response. The Reko decompiler recovers the integer divisors by performing a divide and conquer search using mediants. Reko starts by recognizing the pattern where the high word of a 64-...
John Källén's user avatar
7 votes

Reverse engineering a golang binary file

I'm afraid your intentions to find memory usage may need both static and dynamic analysis. Run-time events can cause more or less memory usage. I will write my general findings about reversing Go ...
Kerim Can Kalıpcıoğlu's user avatar
6 votes
Accepted

16 bit Dos string concat function

It's a minor speed optimization. The main loop for moving characters use movsw (move words) which was probably slightly faster than moving bytes. However, in case the number of bytes is odd, one byte ...
Igor Skochinsky's user avatar
  • 36.8k
6 votes
Accepted

Are there any static binary rewriting tools?

I just extracted the following list during my research of this paper: "Reassembleable Disassembling" Shuai Wang, Pei Wang, and Dinghao Wu, The Pennsylvania State University The following list ...
knx's user avatar
  • 1,257
6 votes
Accepted

Is there a way to find out which hash standard by studying the source code?

This is quite likely either a botched RIPEMD128 or something very similar, as otus also commented. You wanted to know how to approach such a task so I'll explain what I did. Typically, when trying ...
Johann Aydinbas's user avatar
6 votes

Radare2 Disassembler How Do You Organize Visual Panels (V!)?

Use TAB to move between the windows, use e to change name and command of a specific panel you are on. Use w to enter the window mode. "Window mode" allows you to control how the panels look like. In ...
Megabeets's user avatar
  • 8,999
6 votes
Accepted

What is "nullsub_XXX" in vtable in IDA

Welcome to the Reverse engineering stack exchange Q&A site! Although you only asked about nullsub_, you described ___cxa_pure_virtual slightly incorrectly so I'll describe it as well nullsub_X IDA ...
NirIzr's user avatar
  • 11.8k
5 votes
Accepted

Mapping Android resource IDs to resource string

Using apktool you can decompile a program's resources. Also you can use JEB to view the resource id. In res/values, you can find the id using name in public.xml (or something similar, e.g. publics....
Misty's user avatar
  • 428
5 votes
Accepted

Lifting up binaries of any arch into an intermediate language for static analysis

My recommendation is to use libVEX, as it's the most robust intermediate code library that I know of. It's part of Valgrind and supports a load of architectures. You can either use libVEX in a C/C++ ...
joxeankoret's user avatar
  • 4,488
5 votes
Accepted

Wierd names in import table

As @guntram-blohm says, these are mangled C++ functions. If you demangle the names (using, for example, an online demangler) you will get the fully decorated function names: public: __thiscall ...
joxeankoret's user avatar
  • 4,488
5 votes
Accepted

How can I get the shared libraries' function calls using angr

However I don't know how to get the function calls from the nodes Are you saying you want to know which function a node belongs to, or which function a node is calling? For the former, each block ...
Fish's user avatar
  • 194
5 votes
Accepted

Dynamic analysis (Frida) reveals instance of a class that doesn't exist in the source code (dex2jar)

There are multiple possibilities how this might happen. The code is loaded dynamically at run-time, e.g. for an [obfuscated/encrypted] dex file that is present in the APK file but does not follow the ...
Robert's user avatar
  • 1,057
5 votes
Accepted

How do I reverse an exe packed with an unknown packer?

You don't throw things at IDA and hope for the best and, as an analyst, you don't relay on automatic tools this much. That's clearly a sign you need to start doing the heavy lifting. A packer is ...
Margaret Bloom's user avatar
4 votes

Lifting up binaries of any arch into an intermediate language for static analysis

I reviewed about 14 intermediate representations for the project I'm working on. It seems like any author (even for PhDs and master thesis) found all other existing IRs lacking and invented their own ...
Nordwald's user avatar
  • 2,906
4 votes

Lifting up binaries of any arch into an intermediate language for static analysis

I would like to add BAP to your list. Disclaimer, I'm one of the authors. We just released the 1.0.0 version. This is our tenth public release (after about ten years of in-house development). ...
ivg's user avatar
  • 141
4 votes

Mapping Android resource IDs to resource string

Yunchao Guan's answer is correct. For example, i recently unpacked an application (zaka.com.amperemeter-1.apk, yes, it's zaka.com, not com.zaka as it shoule be) to improve the bad German translation ...
Guntram Blohm's user avatar
4 votes

Lifting up binaries of any arch into an intermediate language for static analysis

Radare2 may be what you are looking for: https://github.com/radare/radare2 They lift everything to an intermediate language called ESIL so that it can be emulated easily. This code can be ...
Jeff's user avatar
  • 49
4 votes

What are the overall features used in static analysis of malware? Is file property among the features used in static analysis of malware?

The author does not appear to explicitly explain what "file properties" are, but some of the papers cited in relation to "file properties" discuss the role of malware families in machine-learning ...
julian's user avatar
  • 7,158
4 votes

Obfuscated VBE malware script analysis

This script is mostly obfuscated through renaming of variables and function names. I recommend using a tool such as Visual Studio Code Where you can right click the variable or function and select ...
chentiangemalc's user avatar
4 votes

methods that have zero usage in jadx?

If Jadx can not find any usage of a method this may be a false result: A lot of methods can't be decompiled by Jadx, this can happen especially on lengthy or complex methods. All method calls within ...
Robert's user avatar
  • 1,057
4 votes
Accepted

The C166 family code meaning

Okay, so let's start by converting the first four instructions to rough pseudocode. I'll include the instructions as comments so you can see what each one does. r5 = r4; // mov r5, r4 - ...
Sparkette's user avatar
  • 166
3 votes

Automated Branch Input Generation

there are some projects working on it. The most prominent one may be angr. Please note that each of this projects (as of now) is not to be used in production, since they are mostly unstable, work only ...
Nordwald's user avatar
  • 2,906
3 votes

What is the relationship between the Windows API and the C run time library?

To answer the main question, some C functions call WinAPI functions. Some don't. There are things that you have to call WinAPI function for. (e.g. exit()) There are things that you have convenient ...
Shmuel Fomberg's user avatar
3 votes

What tools exist for excavating data structures from flat binary files?

Hexinator has a similar feature to binary templates of 010 Editor that is called a "grammar". It allows to insert numbers, strings, structs and binary blobs. If that's not enough, it has scripting ...
Thomas Weller's user avatar
3 votes
Accepted

Figure out whether a function has return value of not?

I see several problems with that approach: Functions that return double values don't use eax Functions that return structs don't neccesarily use eax, see here return values from many functions, like ...
Guntram Blohm's user avatar
3 votes

Tools to work cooperatively on the same binary

A new tool that's actively developed on github is IDArling (Previously called IDAConnect). According to its developers, Alexandre Adamskiand and Joffrey Guilbon, it's inspired by SolIDArity (which ...
NirIzr's user avatar
  • 11.8k
3 votes

Programmatically reverse-engineering a dynamic dispatch method

Wow, I actually figured out enough of angr to do it. Consider this C program (an extremely simplified scale model of qt_metacall): #include <stdio.h> int foo(void) { return puts("foo"); } ...
Michele Cicciotti's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible