dynStruct
A reverse engineering tool that uses DynamoRIO and Capstone to automatically recover data structures from ELF binaries by monitoring memory accesses.
What is dynStruct?
dynStruct is a reverse engineering tool that automatically recovers data structures from compiled ELF binaries. It works by instrumenting a running program with DynamoRIO to monitor all memory read and write operations, then analyzes these accesses to reconstruct the probable layout of structures like arrays, nested structs, and pointers. This helps analysts understand undocumented binary internals without source code.
Security researchers, malware analysts, and software reverse engineers who need to understand the internal data structures of compiled programs, especially when dealing with legacy, obfuscated, or malicious binaries.
dynStruct offers a unique combination of dynamic runtime analysis and automated structure inference, providing a more accurate view of actual memory usage compared to static analysis alone. Its integrated web interface allows interactive exploration and refinement of recovered structures, streamlining the reverse engineering process.
Overview
Reverse engineering tool for automatic structure recovering and memory use analysis based on DynamoRIO and Capstone
Use Cases
Best For
- Analyzing malware or obfuscated binaries to understand internal data layouts
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
