Dynamic Binary Analysis

security

Definition

Dynamic Binary Analysis

Dynamic binary analysis is binary analysis performed by running the program — typically under a debugger or system-call/library-call tracer, often in a sandbox — and observing its runtime behaviour. It complements static analysis: where static analysis reveals only what the disassembler can recover, dynamic analysis shows the program’s actual state evolution, arguments actually passed, and code paths actually taken.

Tracers

Two non-debugger tracers

Tool	What it traces
strace	every system call the program makes, with arguments and return values
ltrace	every library call the program makes (e.g. strcmp, malloc)

Both are read-only observatories — they do not let you step or modify state, but they answer “what is the program asking the OS / lib for?” with no setup. Running strace ./password_manager reveals that the program expects the password as an argument; running ltrace ./password_manager asdf reveals the strcmp against the actual password.

GDB

The GNU debugger

gdb runs a program under a debugger where execution can be frozen, inspected, and modified. The core commands:

Command	Effect
run	run the loaded program as if from the command line
break <where>	set a breakpoint at an address; execution freezes when it is hit
continue	resume execution after a breakpoint
info registers / info frame	show register contents / the current stack frame
x/<nuf> <what>	print n units of format f from address what (e.g. x/1gx $rax — one giant word, hex, from rax)
disassemble <func>	disassemble the named function
print / p	print the value of an expression
set	change a gdb setting or set a value inside program memory
set disassembly-flavor intel	output disassembly in Intel syntax
nexti / ni	step over the next instruction
stepi / si	step into the next instruction (follow calls)

pwndbg

A GDB plugin made for reverse engineering

pwndbg is a GDB plugin that adds commands and context displays suited to exploit development. All plain gdb commands work; the plugin layers usability on top:

• context — summarizes the current execution context (registers, stack, code) in one view;
• telescope — displays memory dumps and recursively dereferences pointers;
• search — searches for bytes, strings, integers, or pointers in the program’s memory space.

Tampering With State

The advantage of dynamic over static

A debugger can also modify state, which static analysis cannot. The slide demonstrates this on password_manager_v2: after the call to strcmp, setting the RAX register to 0 with set $rax = 0 makes the subsequent check behave as if the strings had compared equal, because strcmp returns 0 on equality. That bypasses the password check without ever recovering the password itself — a clean illustration of the difference between defeating a check and understanding the program.