Slashdot Mirror
Learning Reverse Engineering
TheBoostedBrain writes "Mike Perry and Nasko Oskov have written a very complete article about reverse engineering. It provides an introduction to reverse engineering software under both Linux and Windows."
← Back to Stories (view on slashdot.org)
How long before this site is taken down for DMCA violations?
My journal has hot
I can't believe they left out truss/strace/ktrace. Even without debugging symbols, these utilities can tell you what system calls are being called, when they are called, and what arguments are being passed.
truss under Solaris is even more useful than strace under Linux or ktrace under the BSDs; you can also trace function entry points into user-level ELF solibs.
Do daemons dream of electric sleep()?
do the authors of the book linked have the text available as a single PS or PDF file?
I'm not sure that their claim that anyone who's read a "How to Learn [C|C++|Java|*] in nn Days" should be able to follow the article is correct, but it's a good intro nonetheless. The section on binary formats (ELF, etc.) is particularly useful.
mimosa: ~ $ echo 'engineering' | rev
gnireenigne
What more do you need to know?
`(f) REVERSE ENGINEERING- (1) Notwithstanding the provisions of subsection (a)(1)(A), a person who has lawfully obtained the right to use a copy of a computer program may circumvent a technological measure that effectively controls access to a particular portion of that program for the sole purpose of identifying and analyzing those elements of the program that are necessary to achieve interoperability of an independently created computer program with other programs, and that have not previously been readily available to the person engaging in the circumvention, to the extent any such acts of identification and analysis do not constitute infringement under this title.
`(2) Notwithstanding the provisions of subsections (a)(2) and (b), a person may develop and employ technological means to circumvent a technological measure, or to circumvent protection afforded by a technological measure, in order to enable the identification and analysis under paragraph (1), or for the purpose of enabling interoperability of an independently created computer program with other programs, if such means are necessary to achieve such interoperability, to the extent that doing so does not constitute infringement under this title.
`(3) The information acquired through the acts permitted under paragraph (1), and the means permitted under paragraph (2), may be made available to others if the person referred to in paragraph (1) or (2), as the case may be, provides such information or means solely for the purpose of enabling interoperability of an independently created computer program with other programs, and to the extent that doing so does not constitute infringement under this title or violate applicable law other than this section.
`(4) For purposes of this subsection, the term `interoperability' means the ability of computer programs to exchange information, and of such programs mutually to use the information which has been exchanged.
DMCA
Whenever the offence inspires less horror than the punishment, the rigour of penal law is obliged to give way...
Well this was most unexpected. We still have a lot of work to do on this book, and are still in the process of looking for a publisher. In fact, both Nasko and I were working on the book as this was posted (quite a shock!). We're still putting together screenshots, describing debugging utilities, etc..
In fact, the book looks more complete than it actualy is. Most of the chapters are basically just an outline that we've been filling in as we go along.
Keep checking the book periodically for more updates, as again, this is a work in progress. If you notice any ommissions, or have any contributions, we would be glad to take them.
Thanks,
Nasko Oskov & Mike Perry
This. One of the funnier 404 messages I've seen. Take a look at the source for the page so you won't have to wait for the slow version of the text. :)
Very Good article, and I admit that I did not understand all of it, nor did I read all of it. However I did forward it along to a couple of friends who do not regularly /.
Here is a reverse engineering feat for you all...POS(Point of Sale) terminal equipment. Specifically to replace NSC(National Systems Corporation) and similar diamond touch gear. If you can reverse engineer a system for taking customer's orders(think pizza/food), showing it on multiple screens around the store, and keeping track of inventory, sales numbers and statistics, customer tracking and history...wow you would be great. Nobody wants to spend $15-30,000 for a new POS system. Nobody.
Biggest problem is that these small operators spend that much money on the system, that they are obligated and forced into using it for 10+ years, well after the hardware(monitors/keyboards) wear out. Then get stuck purchasing proprietary stuff at the same cost it was at the original purchase price...several hundred dollars for a custom keyboard...get real.
Somebody please show me where there is a project to reverse engineer this with an X window under RedHat/Slack. Even terminal would be fine. The current system runs text only...over 1 pair of copper in a phone plug(rj11).
Who is this that even the wind and the waves obey Him? Surely this computer must submit also!
When the Thought Police arrest you so that the MPAA can sue you for intent to possibly defraud, larsony of imaginary profits, and programming without a liquor license.
You can't judge a book by the way it wears its hair.
The part i had time to read before the *you know what* was really good. But there is something else. This server probably has the best 404 page i have seen. Some people spend some time to make a really nice 404 page?
:)
Ooo.. now i see. it's ".edu"
Slashdot Sig. version 0.1alpha. Use at your own risk.
For an excellent source of reverse engineering material, you really should check out the old Fravia pages. This is the original stuff right here.
Along with reversing tutorials and materials, there is a rich history behind this stuff. A man named +ORC published a tutorial on how to reverse engineer a Windows program called pooldemo.exe. From this text, an era was born. The Fravia website was created and was home to the +HCU. Many people sought after the true identity of +ORC, and he left a strainer (riddle) behind that would take you to a URL where he would be unmasked supposedly. Just look up "ORC riddle" on google for details. Neat stuff!
But now I know why, due to the authors' comments. Thanks for the pointer to the TOC entry though, don't how I missed that.
For the readership out there, I'm sure those will be covered in the future; in the meantime, read your strace/ktrace/truss man pages. Run them on the application you're trying to RE before doing *anything* else. Sometimes, those dumps can provide *amazing* insight into the behaviour and structure of the program (particularly if you're good with 'grep'), especially if you're trussing and using the program interactively.
Do daemons dream of electric sleep()?
Given some of the code I get to deal with (19(7/8)0s vintage C, much of which is older than I am) it's probably easier to reverse engineer the binary and look at it there...
Beep beep.
There was a slick plastic game called Black Box back when thinking games like Mastermind were raking in the dough. There are Java and PalmOS varieties of the game. It's a nice three-minute game to while away a bus stop wait, and it helps you get in the mindset of what reverse engineering really means.
The inside of the Black Box is an 8x8 square. There are 8 ports on each side of the square. One player sets some marbles inside the covered square, and the other player tries to deduce their locations by the behavior of "rays" entering and exiting the box ports. Some rays go all the way through, some reflect off the balls inside, and some glance off the balls and go out some other side of the box.
[
Only two sections are complete.
When will I be able to get this in paperback so I can read it while I'm sittin' on the can?
This book is pretty weak. I skimmed through it and no where did I see win32dasm dead listings or hands on reversing. It seems like it just tries to explain different windows and unix tools people might use for reversing. Comments like this certainly should have been left out: If you don't know assembly language, at the end of this book you will literally know it inside-out I mean gimme a break. In less than a hundred pages of text, no one is going to learn x86 asm "inside-out." Chapter 9, which many people would be interested in, is incomplete. I wouldn't waste my time. Go search for "fravia pages reverse engineering" on google. That material took years to put together.
Quote from the introduction of the book:
:)"
"We don't know about you, but to us, software that we don't have source code to just pisses us off. So we figure: screw it, lets do some damage.
Cheap comments like this really degrade this book.
Here are a couple of beginner-level articles I've written on reverse-engineering malicious code:
Reverse Engineering Hostile Code
Alien Autopsy: Reverse Engineering Win32 Trojans on Linux
Recently I came by this book: Code Reading - The Open Source Perspective, which has the same idea except for when you have the source of a program and not only a binary.
bash$
a mention of IDA pro, W32Dasm, softice. These are the tools of the trade.
These are cool guys, I've gone to a few of their SIGMil meetings. Its cool to think i've partied with some guys who've been slashdoted (also perry TA'd a class i took in the fall). Nasko likes to hit on my girlfriend (tho he's only seen her twice).
Good job guys! Keep it up!
They also run the most excellent ACM Special Interest Group at U of Illinois- Urbana Champaign. Anybody who's interested in this kind of research should check it out when they host meetings in the fall.
--- Kicking the Cheat since late 2002
Or your could release the source code -- in Pascal. Anyone without enough programming skill to understand your system will rather go blind than read Pascal code.
Thanks, but no need - we've got boatloads of bandwidth at uiuc, and the web server is hardly noticing:
[staffin@winston staffin]$ uptime
21:20:19 up 79 days, 18:17, 3 users, load average: 0.24, 0.27, 0.32
Not bad. It's an ultra5/360 running Debian with 256mb of ram, btw. I think this pretty much demonstrates that the slashdot effect is all about bandwidth, not the speed of the server.
Is it supposed to cause certain groups of people to turn their noses up at this? What group would that be?
How about the "I'm not going to cite this book in a bibliography because I cite only works that I would recommend to fellow professionals, who by the way do not appreciate obscene humor in the context of their jobs" group?
I can't think of any group or person with that reaction who would be of the inclination to reverse engineer things.
You mean like Compaq? Lots of Big Corporations(tm) reverse-engineer their competitors' products in order to learn how to interoperate. Such reverse engineering is exempt to an extent from the DMCA's circumvention ban (17 USC 1201) when under the supervision of an entity that can fund a legal defense.
Will I retire or break 10K?
http://www.acm.uiuc.edu/~staffin/reveng.pdf - Here is the same pdf mentioned above, only on a site that isn't about to get slashdotted (on the same server as the original site, in fact). Have at it!
you might want to have a look at AntiCrack which is a huge collection of tutorials cracking , reverse engineering, and programming. They also have a copy of the Old Fravia'Site, the new one being about searching).
;-)
There's a few games/challenges out there about reverse engineering, cracking, logic and programming. Give them a try if you wish (Arcanum is really nice):
AngularVision, Apotheosis, Arcanum, Aspect, Aspect2, C&CDisIncorporated, CyberArmy, Disavowed, Electrica, Escape, HackME, HackersGames, HackersLab, HackQuest, Hybrid, ICEFortress, Lamebulun, Mod-X, NetSplit, NGSEC'sSecurityGame, ProblemSetArchive, ReverserCourse, SlyFX, TheGame, and Try2hack.
have fun
-- search the web
Are there any lawyers here that can say whether packet sniffing is indeed a form of Reverse Engineering and could then be prohibited by an EULA? Common sense would tell me that it can not because it would be analogous to having a reasonable expectation of privacy when talking with someone inside your home but not when shouting to your neighbor through an open window.
Not exactly complete. My research
area is reverse engineering. The book only
talks about low level reverse engineering
(i.e. executable code). Most of the research
in the area is at the source level.
This is not a criticism targeted at theauthors,
but at the submitter.
Atlas stands on the earth and carries the celestial sphere on his shoulders.
What we need most are methods to reverse engineer device drivers.
Let's say for example, a certain manufacturer of popular media cards actually has linux drivers for their hardware, running on an ARM in a setup box, but refuses to release these drivers, open or closed, to pc users. If I had said drivers in hand, could I port them to i386?
tcboo
As far as specifications go with hardware...the simpler it is the better. Honestly, do you want to code to something that is unfamiliar? No. You want to run x11 on a Plain old P4 or something with 5 pci video cards in it. vga monitors. Not monochrome monitors running off two wires that make ugly text displays. Something simple to program, and even simpler to replace.
Seriously, you could sell this commercially if you found a backer. Give them the software for free, and sell them the system. One computer, 6 keyboards and 6 monitors. Thats all you need to supply, and you can charge them US$5000 for it. Sell upwards of fifty of these darn things to little mom and pop pizza places and they would be happy, and you would clear $1500 a piece...then start selling to Pizza Hut, Domino's, Papa John's...and make a shitload as they begin replacing their equipment and buying yours.
Be sure to offer them support with certain little things for a specified ammount of time, and charge them like $2000 for a one year service contract.
Modify your code with a couple different modules, and begin handling burgers and fries instead of just pizza sizes, toppings, and cokes...and then you open your market up to smaller chains like A&W, White Castle, and eventually anybody.
there is a need for this type of software and hardware solution, and all businesses feel it roughly every 8 years or so. Thats a pretty good market. Get your hands on some old equipment and see how the inventories worked, the numbers added up, and displayed. Wow. Make yourself a living in 30 long and difficult steps.
Who is this that even the wind and the waves obey Him? Surely this computer must submit also!