dynStruct
dynStruct is a tool for monitoring memory accesses of an ELF binary and recovering structures of the original code.
dynStruct is a tool for monitoring memory accesses of an ELF binary and recovering structures of the original code.
Checked October 2026.
dynStruct is a tool using dynamoRio to monitor memory accesses of an ELF binary via a data gatherer, and use this data to recover structures of the original code. dynStruct can also be used to quickly find where and by which function a member of a structure is write or read.
Papers: dynStruct was the subject of a master thesis and a publication.
Requirements: Data gatherer, CMake >= 2.8, DynamoRIO (avoid the last release, recommended version at DynamoRIO cronbuild or build 7.91.18109).
Structure recovery and web interface: Python3, Capstone, Bottle.
Setup:
Data gatherer Usage: drrun -opt_cleancall 3 -c <dynStruct_path> <dynStruct_args> -- <prog>
No core features are listed for this product yet, so check the vendor's documentation for the full feature list.
No integrations are listed for this product yet. Check the vendor's documentation, or ask the vendor which integrations and APIs it supports.
Common questions about dynStruct: features, pricing and alternatives.
dynStruct is a product in the Malware Analysis category. It covers ELF, Binary Analysis and Memory Forensics.
dynStruct is free. Download and setup instructions are at https://github.com/ampotos/dynStruct/.
Alternatives to dynStruct listed on CybersecTools:
Compare all dynStruct alternatives at https://cybersectools.com/alternatives/dynstruct
dynStruct is available as on-premises software. It is listed for mid-market companies and enterprises. It is free.
Side by side: features, pricing model and the company behind each one.
DroidBox is a dynamic analysis framework for Android applications that monitors runtime behavior, network activity, file operations, and security events while generating behavioral visualizations.
Sandbox platform for interactive malware detonation, record/replay, and forensic analysis
A debugger tool for reverse engineers, crackers, and security analysts, with a user-friendly debugging UI and custom agent support.
edb is a powerful debugger for Linux binaries, enhancing reverse engineering efforts with a user-friendly interface and extensible plugins.
A freeware suite of tools for PE editing and process viewing, including CFF Explorer and Resource Editor.
Fernflower is an analytical decompiler for Java with command-line options and support for external classes.
On our shortlist?
No shortlist covers this product's category yet. The closest is Best MDR Solutions for Business.
Get a summary of this page from your assistant.
Mandos MCP: ask about all 9,032 products.
Connect your AI
