Blue Fox

CHAPTER 10Static Analysis

In Part I, “Arm Assembly Internals,” you learned about the most common instructions you will encounter in disassembly. Now it is time to apply that knowledge and learn how to analyze the program flow of a binary. The examples you will see in this chapter are simple and easy to follow, and going over them in detail will help you connect the dots between the bits and pieces you have already learned.

But what is static analysis? The term static analysis has a different meaning depending on who you ask. But there is one characteristic everyone agrees on: it's the analysis of a file in its static form, without any execution. In this chapter, static analysis refers to the low‐level analysis of a binary.

Static analysis is the precursor of dynamic analysis. To inspect a program during its execution, you need to understand its basic properties first. After all, you need to know the environment and resources a program needs for execution. Light static analysis helps you prepare the right environment and tools to analyze a file based on its file type and understand its structure based on its file format.

Often, gathering information about a file's basic properties isn't enough to continue with the dynamic analysis stage. In these cases, you need to identify the points in the code where you need to watch it interact with the system to gain a deeper understanding of its functionalities. For example, if a malicious binary performs network tasks, decrypts data, ...