Blue Fox

CHAPTER 11Dynamic Analysis

In the previous chapters you learned the fundamentals of Arm assembly and static analysis of disassembled code. This knowledge helps you identify control flow patterns, trace user‐controlled input, and analyze functions with a specific goal in mind. Now it's time to take it a step further and analyze a program in its dynamic, actively running state.

Debuggers are mainly used for one of two main purposes: to examine memory images (aka core dumps) associated with a crashed program or process or to examine the execution of a program or process in a controlled manner.

Debugging is especially useful for beginners who want to learn an assembly language. Learning assembly can get tedious and overwhelming, especially when presented with a 6,000‐page reference manual. The best way to learn assembly, in my experience, is to understand the most common instructions and learn the more exotic instructions as you run into them. When you open a binary in a disassembler, you will likely encounter instructions you have never seen before. Looking them up in the Arm reference manual is a good start, but seeing them in action and observing their behavior will solidify this knowledge.

Static and dynamic analysis come hand in hand. If you just run a program in a debugger, it will simply run and finish, or crash if triggered. The prerequisite for debugging is at least a minimum understanding of the binary you want to debug. Therefore, the first step is always static analysis. ...