Slashdot Mirror
Learning Reverse Engineering
TheBoostedBrain writes "Mike Perry and Nasko Oskov have written a very complete article about reverse engineering. It provides an introduction to reverse engineering software under both Linux and Windows."
← Back to Stories (view on slashdot.org)
I can't believe they left out truss/strace/ktrace. Even without debugging symbols, these utilities can tell you what system calls are being called, when they are called, and what arguments are being passed.
truss under Solaris is even more useful than strace under Linux or ktrace under the BSDs; you can also trace function entry points into user-level ELF solibs.
Do daemons dream of electric sleep()?
`(f) REVERSE ENGINEERING- (1) Notwithstanding the provisions of subsection (a)(1)(A), a person who has lawfully obtained the right to use a copy of a computer program may circumvent a technological measure that effectively controls access to a particular portion of that program for the sole purpose of identifying and analyzing those elements of the program that are necessary to achieve interoperability of an independently created computer program with other programs, and that have not previously been readily available to the person engaging in the circumvention, to the extent any such acts of identification and analysis do not constitute infringement under this title.
`(2) Notwithstanding the provisions of subsections (a)(2) and (b), a person may develop and employ technological means to circumvent a technological measure, or to circumvent protection afforded by a technological measure, in order to enable the identification and analysis under paragraph (1), or for the purpose of enabling interoperability of an independently created computer program with other programs, if such means are necessary to achieve such interoperability, to the extent that doing so does not constitute infringement under this title.
`(3) The information acquired through the acts permitted under paragraph (1), and the means permitted under paragraph (2), may be made available to others if the person referred to in paragraph (1) or (2), as the case may be, provides such information or means solely for the purpose of enabling interoperability of an independently created computer program with other programs, and to the extent that doing so does not constitute infringement under this title or violate applicable law other than this section.
`(4) For purposes of this subsection, the term `interoperability' means the ability of computer programs to exchange information, and of such programs mutually to use the information which has been exchanged.
DMCA
Whenever the offence inspires less horror than the punishment, the rigour of penal law is obliged to give way...
Well this was most unexpected. We still have a lot of work to do on this book, and are still in the process of looking for a publisher. In fact, both Nasko and I were working on the book as this was posted (quite a shock!). We're still putting together screenshots, describing debugging utilities, etc..
In fact, the book looks more complete than it actualy is. Most of the chapters are basically just an outline that we've been filling in as we go along.
Keep checking the book periodically for more updates, as again, this is a work in progress. If you notice any ommissions, or have any contributions, we would be glad to take them.
Thanks,
Nasko Oskov & Mike Perry
This book is pretty weak. I skimmed through it and no where did I see win32dasm dead listings or hands on reversing. It seems like it just tries to explain different windows and unix tools people might use for reversing. Comments like this certainly should have been left out: If you don't know assembly language, at the end of this book you will literally know it inside-out I mean gimme a break. In less than a hundred pages of text, no one is going to learn x86 asm "inside-out." Chapter 9, which many people would be interested in, is incomplete. I wouldn't waste my time. Go search for "fravia pages reverse engineering" on google. That material took years to put together.
Here are a couple of beginner-level articles I've written on reverse-engineering malicious code:
Reverse Engineering Hostile Code
Alien Autopsy: Reverse Engineering Win32 Trojans on Linux
Recently I came by this book: Code Reading - The Open Source Perspective, which has the same idea except for when you have the source of a program and not only a binary.
bash$
http://www.eagle-i.com/JAVA/bb.html
Unfortunately, no one can be told what my sig is...
a mention of IDA pro, W32Dasm, softice. These are the tools of the trade.
Thanks, but no need - we've got boatloads of bandwidth at uiuc, and the web server is hardly noticing:
[staffin@winston staffin]$ uptime
21:20:19 up 79 days, 18:17, 3 users, load average: 0.24, 0.27, 0.32
Not bad. It's an ultra5/360 running Debian with 256mb of ram, btw. I think this pretty much demonstrates that the slashdot effect is all about bandwidth, not the speed of the server.
http://www.acm.uiuc.edu/~staffin/reveng.pdf - Here is the same pdf mentioned above, only on a site that isn't about to get slashdotted (on the same server as the original site, in fact). Have at it!
Yes: http://www.acm.uiuc.edu/~staffin/reveng.pdf
you might want to have a look at AntiCrack which is a huge collection of tutorials cracking , reverse engineering, and programming. They also have a copy of the Old Fravia'Site, the new one being about searching).
;-)
There's a few games/challenges out there about reverse engineering, cracking, logic and programming. Give them a try if you wish (Arcanum is really nice):
AngularVision, Apotheosis, Arcanum, Aspect, Aspect2, C&CDisIncorporated, CyberArmy, Disavowed, Electrica, Escape, HackME, HackersGames, HackersLab, HackQuest, Hybrid, ICEFortress, Lamebulun, Mod-X, NetSplit, NGSEC'sSecurityGame, ProblemSetArchive, ReverserCourse, SlyFX, TheGame, and Try2hack.
have fun
-- search the web
Not exactly complete. My research
area is reverse engineering. The book only
talks about low level reverse engineering
(i.e. executable code). Most of the research
in the area is at the source level.
This is not a criticism targeted at theauthors,
but at the submitter.
Atlas stands on the earth and carries the celestial sphere on his shoulders.
Georgia Tech's Reverse Engineering Group also has a whole lot of info on the topic here : http://www.cc.gatech.edu/reverse/