Lukas' Notes

security

Definition

Binary Analysis

Binary analysis is the practice of collecting information about a program from its compiled binary rather than its source, in order to understand behaviour, hunt for bugs, or reverse-engineer unknown code. It comes in two complementary forms: static analysis, which inspects the file without executing it, and dynamic analysis, which runs the program under a debugger or tracer to observe its runtime behaviour.

The Two Modes

Complementary, not alternatives

Static analysis is safe — nothing is executed, so a malicious binary cannot infect the analyst’s machine — but it can only see what the disassembler and decompiler can recover, and obfuscation hides a lot. Dynamic analysis shows the program’s actual behaviour, including anything that only manifests at runtime, but runs the risk of triggering the malware it studies, so it is usually done in a sandbox or on a VM. The two are combined in practice: static recon to find entry points, strings, and interesting functions; dynamic steps to confirm hypotheses and watch state change.

Tool Families

Tools used against an ELF binary

The standard toolbox splits cleanly along the static/dynamic axis:

  • staticfile, objdump, readelf, strings, ldd (see Static Binary Analysis);
  • dynamicgdb + pwndbg, strace, ltrace (see Dynamic Binary Analysis);
  • supporting — the Ghidra reverse-engineering suite (decompiler), the exploit-development library pwntools, and checksec (which reports properties such as PIE and stack canaries).