binary-triage

Binary Triage

Instructions

We are triaging a binary to quickly understand what it does. This is an initial survey, not deep analysis. Our goal is to:

1. Identify key components and behaviors
2. Flag suspicious or interesting areas
3. Create a task list of next steps for deeper investigation

Binary triage with ReVa

Follow this systematic workflow using ReVa's MCP tools:

1. Identify the Program

• Use get-current-program to see the active program
• Or use list-project-files to see available programs in the project
• Note the programPath (e.g., "/Hatchery.exe") for use in subsequent tools

2. Survey Memory Layout

• Use get-memory-blocks to understand the binary structure
• Examine key sections:
  • .text - executable code
  • .data - initialized data
  • .rodata - read-only data (strings, constants)
  • .bss - uninitialized data
• Flag unusual characteristics:
  • Unusually large sections
  • Packed/encrypted sections
  • Executable data sections
  • Writable code sections

3. Survey Strings

• Use get-strings-count to see total string count
• Use get-strings with pagination (100-200 strings at a time)
• Look for indicators of functionality or malicious behavior:
  • Network: URLs, IP addresses, domain names, API endpoints
  • File System: File paths, registry keys, configuration files
  • APIs: Function names, library references
  • Messages: Error messages, debug strings, log messages
  • Suspicious Keywords: admin, password, credential, token, crypto, encrypt, decrypt, download, execute, inject, shellcode, payload

4. Survey Symbols and Imports

• Use get-symbols-count with includeExternal=true to count imports
• Use get-symbols with includeExternal=true and filterDefaultNames=true
• Focus on external symbols (imports from libraries)
• Flag interesting/suspicious imports by category:
  • Network APIs: connect, send, recv, WSAStartup, getaddrinfo, curl_*, socket
  • File I/O: CreateFile, WriteFile, ReadFile, fopen, fwrite, fread
  • Process Manipulation: CreateProcess, exec, fork, system, WinExec, ShellExecute
  • Memory Operations: VirtualAlloc, VirtualProtect, mmap, mprotect
  • Crypto: CryptEncrypt, CryptDecrypt, EVP_, AES_, bcrypt, RC4
  • Anti-Analysis: IsDebuggerPresent, CheckRemoteDebuggerPresent, ptrace
  • Registry: RegOpenKey, RegSetValue, RegQueryValue
• Note the ratio of imports to total symbols (heavy import usage may indicate reliance on libraries)