Dynamic Analysis

Dynamic analysis consists of running the binary and observing its behavior in real time: what files it opens, what network connections it makes, what system calls it performs, how memory changes, and what it really does (not just what it seems to do in the code). It complements static analysis (Static Analysis): what’s hard to follow reading the disassembly —obfuscated code, runtime encryption, input-dependent logic— becomes clear by running it under observation. It’s essential for analyzing malware and unpacking protected binaries.

What to observe and with what

# system and library calls (high-level behavior)
strace ./binary            # syscalls (open, connect, execve, read/write...)
ltrace ./binary            # library function calls (strcmp, malloc, printf...)
# files, network, processes
lsof / inotifywait         # open files / FS changes
tcpdump / wireshark        # network traffic generated (see net-sniffing)
# internal state (step by step)
gdb + pwndbg/GEF           # registers, memory, flow (see rev-debug)

ltrace is gold in crackmes: if the program does strcmp(your_input, "correct_password"), ltrace shows you the expected password directly.

The case of runtime encryption/obfuscation

Much code (malware, protections) only reveals its real logic when run: encrypted strings decrypted in memory, code that unpacks itself. Static doesn’t see it; dynamic does:

# strings decrypted in memory -> dump the running process's memory
gdb -> dump memory out.bin 0x... 0x...   ; strings out.bin
# or stop right after decryption and read the memory (rev-debug)
# packers: run until the real code is unpacked in memory -> dump

Unpacking

# a packer compresses/encrypts the executable; the real code appears only at runtime
1. run under a debugger until the "OEP" (Original Entry Point, after unpacking)
2. dump the process memory (the now-unpacked binary)
3. rebuild an executable (importrec, etc.) for static analysis
# tools: x64dbg + plugins (Windows), Scylla, upx -d (if standard UPX)

Instrumentation and advanced tracing

# record ALL executed instructions (full trace)
# dynamic instrumentation frameworks:
Frida          runtime hooking (also mobile, see mob-frida)
Pin / DynamoRIO / Qiling   instruction-level instrumentation/emulation
# symbolic execution (automatically explore paths):
angr           solve crackmes automatically by finding the input that reaches "win"

angr (symbolic execution) can solve many crackmes alone: you tell it “I want to reach the address that prints ‘Correct’” and it computes the needed input.

Safe environment (malware)

Dynamic analysis runs the code, so with malware isolation is essential:

# dedicated VM, isolated from the network (or simulated network), with snapshots
# INetSim / FakeNet: simulate the Internet to see what the malware tries to contact without exposure
# never run malware on your real machine (see malware)

For the defense (what malware does to avoid it)

Protected code tries to detect it’s being observed (debugger, VM, sandbox) and change behavior or abort — covered in rev-antidebug. The analyst bypasses it (patch detections, stealthier VMs, hooking).

Testing checklist

strace/ltrace to see syscalls/calls (behavior)
Monitor files/network/processes
GDB for internal state step by step (Debugging with GDB)
Dump memory to see runtime-decrypted strings/code
Unpack protected binaries (OEP + dump)
Instrumentation (Frida) / emulation (Qiling) if needed
Symbolic execution (angr) for crackmes
Malware: isolated environment with simulated network