11
votes
Control flow graph reconstruction projects
Extracting control flow graph in JSON with radare2:
$> python
import r2pipe
r2 = r2pipe.open("/bin/ls")
r2.cmd("aaa") # See radare.today/posts/analysis-by-default/
cfg = r2.cmdj("agj")
https://...
- 880
10
votes
Accepted
Emulating Routers and other Embedded Devices with QEMU
Emulating a complete physical device is always going to be more of an experimental exercise. In this regard you can use firmadyne which aims to emulate Linux based embedded firmware for MIPS and ARM ...
- 6,110
7
votes
Accepted
Control flow graph reconstruction projects
For now, the most efficient approaches in practice seems to follow the principle of symbolic execution. This technique, originally developed to automatically build-up a set of test cases based on a ...
- 19.2k
7
votes
Reverse engineering a golang binary file
I'm afraid your intentions to find memory usage may need both static and dynamic analysis. Run-time events can cause more or less memory usage. I will write my general findings about reversing Go ...
6
votes
Accepted
Is there a way to find out which hash standard by studying the source code?
This is quite likely either a botched RIPEMD128 or something very similar, as otus also commented.
You wanted to know how to approach such a task so I'll explain what I did.
Typically, when trying ...
- 1,391
6
votes
Accepted
Are there any static binary rewriting tools？
I just extracted the following list during my research of this paper:
"Reassembleable Disassembling" Shuai Wang, Pei Wang, and Dinghao Wu,
The Pennsylvania State University
The following list ...
- 1,257
6
votes
Radare2 Disassembler How Do You Organize Visual Panels (V!)?
Use TAB to move between the windows, use e to change name and command of a specific panel you are on. Use w to enter the window mode. "Window mode" allows you to control how the panels look like. In ...
- 9,019
6
votes
Accepted
What is "nullsub_XXX" in vtable in IDA
Welcome to the Reverse engineering stack exchange Q&A site! Although you only asked about nullsub_, you described ___cxa_pure_virtual slightly incorrectly so I'll describe it as well
nullsub_X
IDA ...
- 11.8k
5
votes
Accepted
Lifting up binaries of any arch into an intermediate language for static analysis
My recommendation is to use libVEX, as it's the most robust intermediate code library that I know of. It's part of Valgrind and supports a load of architectures. You can either use libVEX in a C/C++ ...
- 4,643
5
votes
Accepted
How can I get the shared libraries' function calls using angr
However I don't know how to get the function calls from the nodes
Are you saying you want to know which function a node belongs to, or which function a node is calling?
For the former, each block ...
- 194
5
votes
Accepted
Dynamic analysis (Frida) reveals instance of a class that doesn't exist in the source code (dex2jar)
There are multiple possibilities how this might happen.
The code is loaded dynamically at run-time, e.g. for an [obfuscated/encrypted] dex file that is present in the APK file but does not follow the ...
- 1,145
5
votes
Accepted
How do I reverse an exe packed with an unknown packer?
You don't throw things at IDA and hope for the best and, as an analyst, you don't relay on automatic tools this much.
That's clearly a sign you need to start doing the heavy lifting.
A packer is ...
- 186
4
votes
Lifting up binaries of any arch into an intermediate language for static analysis
I reviewed about 14 intermediate representations for the project I'm working on. It seems like any author (even for PhDs and master thesis) found all other existing IRs lacking and invented their own ...
- 2,906
4
votes
Lifting up binaries of any arch into an intermediate language for static analysis
I would like to add BAP to your list. Disclaimer, I'm one of the authors.
We just released the 1.0.0 version. This is our tenth public release (after about ten years of in-house development). ...
- 141
4
votes
What are the overall features used in static analysis of malware? Is file property among the features used in static analysis of malware?
The author does not appear to explicitly explain what "file properties" are, but some of the papers cited in relation to "file properties" discuss the role of malware families in machine-learning ...
- 7,246
4
votes
Obfuscated VBE malware script analysis
This script is mostly obfuscated through renaming of variables and function names. I recommend using a tool such as Visual Studio Code Where you can right click the variable or function and select ...
- 1,267
4
votes
methods that have zero usage in jadx?
If Jadx can not find any usage of a method this may be a false result:
A lot of methods can't be decompiled by Jadx, this can happen especially on lengthy or complex methods. All method calls within ...
- 1,145
4
votes
Accepted
The C166 family code meaning
Okay, so let's start by converting the first four instructions to rough pseudocode. I'll include the instructions as comments so you can see what each one does.
r5 = r4; // mov r5, r4 - ...
- 166
3
votes
Programmatically reverse-engineering a dynamic dispatch method
Wow, I actually figured out enough of angr to do it. Consider this C program (an extremely simplified scale model of qt_metacall):
#include <stdio.h>
int foo(void) {
return puts("foo");
}
...
3
votes
Automated Branch Input Generation
there are some projects working on it. The most prominent one may be angr. Please note that each of this projects (as of now) is not to be used in production, since they are mostly unstable, work only ...
- 2,906
3
votes
What is the relationship between the Windows API and the C run time library?
To answer the main question, some C functions call WinAPI functions. Some don't.
There are things that you have to call WinAPI function for. (e.g. exit()) There are things that you have convenient ...
- 273
3
votes
What tools exist for excavating data structures from flat binary files?
Hexinator
has a similar feature to binary templates of 010 Editor that is called a "grammar". It allows to insert numbers, strings, structs, and binary blobs. If that's not enough, it has ...
- 970
3
votes
Tools to work cooperatively on the same binary
A new tool that's actively developed on github is IDArling (Previously called IDAConnect). According to its developers, Alexandre Adamskiand and Joffrey Guilbon, it's inspired by SolIDArity (which ...
- 11.8k
3
votes
How to get better in re?
https://www.amazon.com/Practical-Reverse-Engineering-Reversing-Obfuscation/dp/1118787315/ is a very good book, especially if you're interested in Windows.
Practical Malware Analysis and especially ...
- 843
3
votes
Decompress and Analyse VMWARE EFI64 bios
Probably the fastest and easiest way to get started with analyzing binaries such this is to begin with using binwalk to scan the file.
Here is the signature scan output for your file:
$ binwalk ...
- 7,246
3
votes
Accepted
re-construction of c code: movsx with test instruction
You may want to familiarize yourself with two's complement notation. It will only extend the sign bit (msb) into the larger register. So, the msb will be extended into all the additional bits -- ...
- 1,341
3
votes
No apparent entry point for stripped, PIE binary using radare2
How can I find the entry point of this binary?
There's a special radare2 command for this, ie:
$ r2 /program_name
-- Change the registers of the child process in this way: 'dr eax=0x333'
[...
- 9,019
3
votes
Finding a particular call to an offset within a vtable using pattern matching
sometimes the call may be performed without an intermediate load, e.g.
call dword ptr [esi+30h]
as for tracking the value loaded into the register, this is a data flow analysis problem and can’t ...
- 36.9k
3
votes
Hybrid binary analysis tool
The basic idea is not new and has been done several times before.
Probably the first working tool was Process Stalker by Pedram Amini.
IDA also has its own little-known tracing feature which can ...
- 36.9k
3
votes
Start Symbolic Analysis at a Given Address with Angr
There sure is.
p = angr.Project("target_binary")
state = p.factory.blank_state(addr=0x400770)
I strongly recommend reading the State Presets section of the docs for more information. Crucially, all ...
- 957
Only top scored, non community-wiki answers of a minimum length are eligible