Static Analysis

Due Date: 2026-05-04 23:59:59
Submission: via GitLab repo

• Static Analysis
  • Introduction
  • Setup
  • Part 1: Static Analysis
  • Part 2: Written Analysis
  • Submission

Introduction

Static analysis lets you understand a binary without executing it. In this assignment you will examine PE and ELF binaries using disassembly and decompilation tools, and provide a write-up of how to solve the challenges.

Setup

Obtain the samples from ada.cs.pdx.edu:/stash/malware_re/crackmes/:

$ scp -r <MCECS>@ada.cs.pdx.edu:/stash/malware_re/crackmes/ ~/malware/samples/hw2/

Part 1: Static Analysis

You should have four sample files. Perform basic static analysis of each sample, documenting the results of each. Then, open each sample in either Ida or Ghidra, and perform in-depth analysis of each file.

General workflow you should make use of:

1. Run static analysis tools, documenting results of each
2. Run the program. None of these are malicious. They are all CTF/crackme style binaries that have been validated safe. Determine what it’s looking for.
3. Load the program in your RE framework of choice, and determine how to get the success condition.
4. Possibly write a script to generate the key (these are often called keygen challenges for that reason)
5. Validate your results

Hint: to run the PE file in linux, you can use the wine tool. If you aren’t running an x86 chip, that won’t work, and you’ll either need to emulate or access a Windows machine in some other fashion (remote lab, borrow one, whatever).

❯ wine crackmepls.exe /dev/null
❯ # or, if you want wine to stop complaining
❯ wine crackmepls.exe 2>| /dev/null

Part 2: Written Analysis

Write a 1–2 page analysis report covering each sample, documenting:

• the results of the static analysis tooling,
• your approach to obtaining the solution,
• what the program does,
• steps you took to find the information you needed, and
• how you were able to generate the solution.

Screenshots are both appreciated and encouraged. An very thorough example style can be seen in this crackme reverse engineering writeup.

Submission

Commit and push hw2/hw2.md with all findings, screenshots from IDA and Cutter, and your written analysis. Include any scripts that you wrote to solve the challenges in the repo as well.