A reverse engineering tool that uses DynamoRIO and Capstone to automatically recover data structures from ELF binaries by monitoring memory accesses.
dynStruct is a reverse engineering tool that automatically recovers data structures from compiled ELF binaries. It works by instrumenting a running program with DynamoRIO to monitor all memory read and write operations, then analyzes these accesses to reconstruct the probable layout of structures like arrays, nested structs, and pointers. This helps analysts understand undocumented binary internals without source code.
Security researchers, malware analysts, and software reverse engineers who need to understand the internal data structures of compiled programs, especially when dealing with legacy, obfuscated, or malicious binaries.
dynStruct offers a unique combination of dynamic runtime analysis and automated structure inference, providing a more accurate view of actual memory usage compared to static analysis alone. Its integrated web interface allows interactive exploration and refinement of recovered structures, streamlining the reverse engineering process.
Reverse engineering tool for automatic structure recovering and memory use analysis based on DynamoRIO and Capstone
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Uses DynamoRIO to track all read and write accesses during execution, providing detailed, runtime-specific insights into memory usage patterns.
Reconstructs C-style structures, arrays, and nested structs from memory access data, accelerating reverse engineering by reducing manual guesswork.
Offers a visual UI to explore raw access data, edit recovered structures, and refine results, streamlining the analysis workflow as shown in the README screenshots.
Handles multi-process programs by generating separate output files for each process, allowing independent analysis of complex applications.
Requires a specific, older build of DynamoRIO due to compilation errors with the latest release, complicating setup and maintenance.
The Python script loads all JSON data into memory, causing potential out-of-memory errors for large binaries, as admitted in the 'Known issues' section.
Acknowledges that exact structure recovery is impossible; results are 'good enough' approximations that often require manual correction and refinement.
Involves compiling the data gatherer with CMake, setting environment variables, and managing multiple dependencies, which can be time-consuming for new users.