Questions tagged [static-analysis]
Static analysis is the analysis code without actually executing it. This is in contrast to dynamic analysis which executes the code.
223 questions
1 vote
0 answers
53 views
Patching an objective C method with NOPs in a Mach-O library
So I am targeting an arm64 Mach-O dynamic library (.dylib), and I want to patch a specific objc method using nops. Here’s the view from binary-ninja: As you can see, the name of the method is ...
- 11
3 votes
1 answer
161 views
Ghidra is missing known code sections found in Binary Ninja. What settings to change in analysis?
I am studying binary lifting and the impacts of intermediate language representations. I have a binary that is an x86 PE file with a stripped header. I have many of these files so I need a more sample ...
- 31
1 vote
0 answers
67 views
Argument section recovery for binaries
I am developing a static analysis automation tool to help me on CTFs. It would be nice for me to discover from where a certain argument of certain functions is coming from (does it come from a ...
- 11
1 vote
0 answers
206 views
Analyse a statically linked binary and extract syscall from it using angr
How to extract all syscalls from analysing a statically linked binary. I have a script written using angr(Latest - v9.2.78) but when I start my script I get few syscalls and the analysis is like hung ...
- 11
1 vote
0 answers
58 views
Retrieve functionality to button - game patching
I'm patching an old game, and I want the retrieve the toggle fullscreen functionality it's supposed to have. In the menu, in the display tab, there is a disabled option of fullscreen mode that you can ...
- 21
3 votes
1 answer
284 views
How can you tell where an assembly function ends?
Finding the start of a function is sometimes obvious - for example if some part of the code has a call foo then foo must be a function. But what about finding the end of a function? I realize tools ...
- 143
5 votes
1 answer
690 views
Disassembling a DOS game with dynamic code/overlays in IDA Pro
I'm working on a disassembly of an old DOS game. (Real old: 16-bit, real mode.) The bulk of the game is in a large resource file of mixed binary and data; the executable basically just loads a chunk ...
1 vote
1 answer
166 views
Unable to understand x86 instruction(s)
Recently I have been given a set of assembly instructions which I must learn to understand. I know an extremely basic level of x86 assembly but I'm starting to come across more nuances that are very ...
- 13
2 votes
0 answers
139 views
Ghidra python - retrieve the name of the called method
I am using Ghidra to build the function call graph of a method in java and therefore I am analyzing the bytecode of java and when I read an "invoke" instruction I have to go back to the name ...
- 21
3 votes
0 answers
116 views
Is there a Capturebat alternative on windows 10 for file capture?
I've been looking for a capturebat alternative that will function on Windows 10 and 64 bit. I'm not interested in capturbat's network capabilities; rather, I'm interested in its capacity to capture ...
- 31
2 votes
0 answers
61 views
How to get the APIs present in a particular block in a CFG using Angr?
I'm doing binary analysis based on Control Flow Graph (CFG). As I suppose to get the APIs from every block in the CFG. I'm finding it very difficult to do so using Angr as I don't have enough grip on ...
- 39
0 votes
1 answer
87 views
Trying to understand this interrupted (?) function prologue
Note: The uninterrupted disassembly is at the bottom Hey, I'm looking at the the assembly and I'm trying to reverse engineer the function Here, it seems like we are saving the previous rbp. Though, it ...
- 101
1 vote
0 answers
121 views
IDA Pro maps wrong variable for offset
I hope there is a proper way to fix my issue. Here's memory layout: .data:004F3D10 char * * gTownObjNames dd offset aMage ; DATA XREF: townManager::SetupTown(void)+245↑r .data:004F3D10 ...
- 33
3 votes
1 answer
2k views
How do I reverse an exe packed with an unknown packer?
I got an assignment to analize an exe file with 97% entropy. It's obviously packed but I got no results from Protection Id or PEid about which packer it used... How can I unpack it if it's possible? ...
- 33
2 votes
1 answer
606 views
Nice documentation of the binary analysis tool "angr", to analyse system calls in statically linked binary and hence possibly draw a system call graph
I am a new master's student in CS. I am into the computer systems domain. I was just thinking of analyzing a statically linked binary to get a sort of database of system calls made in the binary and ...
- 121