Skip to content

Latest commit

 

History

History
116 lines (72 loc) · 3.33 KB

2-reverse-engineering.org

File metadata and controls

116 lines (72 loc) · 3.33 KB
Raw

Reverse engineering

Resources

Basics

Scenarios for RE

  • analysing compiled code (e.g. protocols)
  • finding vulnerabilities
  • exploiting vulnerabilities
  • malware analysis
  • forensics

Reverse engineering mindset

  • software is HUGE, it’s easy to get lost
  • RE is about finding the right place – not about understanding everything

Today we cover

  • searching for strings
  • finding entrypoints
  • understanding disassembly
  • debugging code

What is Reverse Engineering?

img/2-reverse-engineering_files/image-2.png

img/2-reverse-engineering_files/image.png

#+[[file:img/2-reverse-engineering_files/image.png

img/2-reverse-engineering_files/image.png

#+img/2-reverse-engineering_files/Screenshot%20from%202022-02-09%2006-19-45.png

#+img/2-reverse-engineering_files/image-2.png

CPU (x86)

img/2-reverse-engineering_files/image.png

Function frame

img/2-reverse-engineering_files/image.png

Calling conventions, stack vs registers

Assignments, arithmetics, conditionals, loops etc.

ASLR and the Global Offset Table (GOT) and Procedure Linkage Table (PLT)

RISC (e.g. ARM)

img/2-reverse-engineering_files/image.png

Stack-based VMs

  • e.g. JVM/Java, Python etc.
  • bytecode maps more directly to source language
  • easier decompilation: Ghidra, Mocha

Register-based VMs

  • e.g. .NET/CLR, Dalvik/Java etc.
  • infinite number of registers available, unlike real CPUs
  • also easy to decompile: dotPeek, JEB

Exercise session:

CS: For pwn.college, optionally do the introduction Dojo to get accustomed with starting the VSCode- and Desktop workspace. With these workspaces you’ll be ready to hack away without having to download Ghidra or setting up VMs. For RE exercises, use Ghidra in the desktop workspace.

SD: Learning Assembly with OMU