추적과 후킹을 활용한 동적 분석

Static analysis inspects a binary without running it (disassembly, strings). Dynamic analysis watches the program while it executes, revealing behavior that only appears at runtime, such as decrypted strings or network calls.

Packed or obfuscated binaries hide their logic from a disassembler. But to actually do anything, the code must eventually run real instructions and make real syscalls — and that is exactly what dynamic tools capture.

On Linux, strace logs every system call a process makes. It instantly shows files opened, network connections, and arguments passed to the kernel.

Each line is a syscall with arguments and return value:

openat(AT_FDCWD, "/etc/passwd", O_RDONLY) = 3

This reveals the program read /etc/passwd and got file descriptor 3 — behavior invisible in static text.

ltrace traces calls into shared libraries, like strcmp, malloc, or getenv. This is gold for cracking password checks where the comparison happens in libc.

Hooking intercepts a function call to inspect or change arguments and return values. You redirect the original function pointer to your own code, do your work, then optionally call the original.

On Linux you can override any libc function by exporting a replacement in a preloaded shared object. The loader resolves your symbol first.

This overrides strcmp to log every comparison, then calls the real one via dlsym(RTLD_NEXT, ...).

Dynamic debuggers use breakpoints to pause execution. A software breakpoint replaces a byte with 0xCC (INT 3). A hardware breakpoint uses the CPU debug registers DR0-DR3 and can also trip on memory reads/writes.

For heavy automation, frameworks like Frida and Intel Pin inject instrumentation at runtime. Frida lets you script hooks in JavaScript while the target runs — ideal for mobile and live analysis.

Malware fights back. It may call ptrace(PTRACE_TRACEME) to detect a debugger, check timing, or scan for 0xCC bytes. Recognizing these checks is part of dynamic reverse engineering.

You learned to analyze running programs:

• Dynamic analysis reveals runtime behavior static tools miss
• strace traces syscalls; ltrace traces library calls
• Hooking via LD_PRELOAD or Frida intercepts function calls
• Breakpoints (INT 3 / debug registers) and anti-debugging tricks shape the work