Dynamic Analysis

layout

Dynamic analysis is the process of examining the binary file while it is running. This is useful for debugging and tracing the execution flow.

For this, binsider executes the binary and traces the system calls made by it, similar to the strace(1) command.

Simply press enter to start the dynamic analysis.

dynamic analysis

Each line represents a system call with the following format:

[277208] ioctl(1, 21505, 0x7FFFFFFFB900) = -25
├────────┼─────────────┼─────────────────────┤
│        │             │                     │
│        │             │                     │
│        │             │                     └─ Return value of the system call
│        │             │
│        │             └─ Arguments
│        │
│        └─ System call name
│
└─ Process ID

You can use the following keys to interact with the dynamic analysis:

Key	Action
`j` / `k`	Scroll up/down
`t` / `b`	Go to the top/bottom
`/`	Search for value
`r`	Re-run executable
`enter`	Show details

Details

When you press enter, you will get a summary output of the execution:

dynamic summary

This summary includes the percentage of time spent, time in microseconds, time per call, number of calls, errors, and the corresponding system calls which is useful for understanding the binary’s behavior.