Start with the file’s identity and a narrow question. A filename and a detection label are not enough to establish what the bytes do. Static inspection helps locate structures and paths that deserve closer review.
NotHoly’s supported Reverse workflow inspects bounded PE and ELF files without executing them. Availability follows the configured runner. Other formats and dynamic analysis need their own appropriate tools.
Before you start
- A selected sample handled in an appropriate analysis environment, with its original hash recorded.
- The observed format and the task: inspect imports, understand a decoder or explain a selected function.
- Relevant static excerpts and any external observations labeled with their source.
Follow the steps
- Confirm the file hash and format before upload. Keep a separate original so later transformations do not change the evidence you cite.
- Check Reverse mode’s current availability and select the file explicitly. A listed mode is not proof that its runner is online.
- Inspect sections, imports and bounded strings before focusing on one function. Keep offsets and function names with the extracted evidence.
- Trace inputs, transformations and consumers. Ask what the code proves and what would still require runtime observation.
- Cross-check in your disassembler and record limitations such as packing, unresolved calls or missing dependencies.
Use a precise prompt
Adapt to your evidence
Inspect this file statically. Establish its format and identify the functions relevant to configuration decoding. Explain the selected path with offsets or function references. Keep imported capability, possible behavior and observed execution distinct. Do not infer a contacted destination from an embedded string alone.
Verify your work
- The result references the same file hash and supports claims with inspectable source locations.
- The investigation does not mistake an import, label or string for proof that an action occurred.
- Unsupported formats, truncated evidence and unresolved control flow are stated explicitly.
Bring your own evidence into a conversation and work through the next question.
Open chat