There's more...

I mentioned earlier that we would break down these arguments by usefulness. I can tell you they are all useful, just not in every situation. For example, typically, we would want to start looking at all of the header information with the -e argument, which is formatted using the wide format with -W. For example, we have an executable and not an object file; depending on the output, we may want to view section details with -t, and then dump the hexadecimal output for specific sections such as the textdata, and bss sections. From here, we may also want information on the symbols table so that we can identify any functions that might be useful to us later during our dynamic analysis. 

When all we need is verbose output and we don't mind parsing through all of it later, when we automate some of our earlier phases in our methodology for example, the -a-x .text-p .strtab, and -W arguments may be sufficient. Depending on the goal of the analysis, every binary is different and every analysis is different; for example, identify malicious functionality versus vulnerabilities. This will force us to adapt the arguments we use for our tools accordingly, and thankfully, we have the flexibility to do so.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset