Home Static Analysis with WinDbg and IDA
Post
Cancel

Static Analysis with WinDbg and IDA

Binary reversing

While examining compiled executables from low-level languages like C or C++ we often do not have access to the source code. In this case, an analysis of the binary can help us understand the structure, content, and flow of a binary executable itself

A debugger like WinDbg8 for example, can help us to display instructions in plain ordered assembly

Using WinDbg and IDA in binary analysis

Address Space Layout Randomization (ASLR) can cause every binary to have a different address when executing, we cannot always know the base address of an executable in advance. However, if we can gather this information from our debugging session and pass it to IDA, we can synchronize both pieces of information.

Address Space Layout Randomization (ASLR) is a security technique that places program components in random memory locations each time it runs. This randomness makes it much harder for attackers to predict where critical parts are, reducing the chance of successful attacks.

Binary reversing

Binary reversing

Binary reversing

Binary reversing

Binary reversing

Binary reversing

Binary reversing

Binary reversing

Binary reversing

This post is licensed under CC BY 4.0 by the author.