← notes


def: analyzing software, understanding its structure, functionality, behavior, etc. Important for malware analysis, software security auditing, understanding proprietary protocols, cyber forensics, etc.

Note that there exists different reverse engineering techniques for different langagues. Some languages include C/C++, Java, .NET, Assembler, etc. Some platforms inlcude DOS, MacOS X, Unix/Linux, Windows, etc.


• Reverse engineering for beginners
• https://crackmes.one
• x86-asm.md
• os.md


• Machine language: legit 1s and 0s that are pumped into the CPU
• Assembler: Turn assembly code into machine language
• Disassembler: Taking a machine language program and turning it into an assembly language (human-readable) code
- examples include IDA Pro, Ghidra, Objdump, Radare2, GDB
• compilation: taking high-level code and turning it into low-level code, usually assembly
strings [file] -> legit just shows the strings
file [file] -> shows the filetype
- e.g., NT_Crack.exe: PE32 executable (console) Intel 80386, for MS Windows, 13 sections
- also, see ELF
• "patching a jump" - if you want to change the flow of execution of a binary, for example if there is a license check, you can go in with a hex editor (or, disassembler) and literally change the "je" to a "jne" lol

Making ASM

making the assembly file/executable:
c->asm: gcc -S [file]
c->asm w/o fluff: gcc -S -O2 -fno-asynchronous-unwind-tables [file]
c->executable: gcc [file] -no-pie -o [filename]

once we have the assembly file, assemble to an executable:
asm->executable: as [file].s -o [file].o

and link it:
gcc [file].o -o [file]

and execute:


• IDA Pro
• Objdump
• strace - track system calls
• ltrace - track ibrary calls
• hopper


set dis -> dis options
- set disassembly-flavor (intel, etc)
info functions -> show all defined functions
disassemble [function] -> show the asm code for [function]
run -> run the code


Apple (of app people, wtf) has a nice guide: developer.apple.com/library/archive/documentation/DeveloperTools/gdb/gdb/gdb_6.html

info breakpoints -> shows the current breakpoints
delete [breakpoint] -> delete whatever breakpoint
break [function] -> set breakpoint at function
- break *main
break +offset, break [linenum], break *address
- example -> break *main+88 (will break at +88) in the lil disassembler thing)

Note because linux has Address space layout randomization, if you want to set a specific memory address you'll prob have to disable ASLR via echo 0 | sudo tee /proc/sys/kernel/randomize_va_space

Observing Stuff

Because GDB is the goat, we can step through the program with it, check out memory addresses, etc.

continue, c -> continue execution till breakpoint
info registers -> shows the content of all registers
x/d [address] -> inspect the value at a memory location
stepi, si -> execute one assembly instruction at a time


Each structure in C has a certain "mirror" structure in assembly.

(note, this section is generally in intel assembly)

For loop

for (int i = 1, i < 10, i++){
// do something

will have the structure:
// add items to stack
mov addr1, i (1)
mov addr2, 10

// compare operation
cmp addr2, 0xa # note how this is one more than 10 in hexadecimal

// conditional jump after the loop
jg some addr after loop

// "do something"

// do the increment condition
add addr1, 0x1

// jump back to compare operation
jmp to compare

If you're trying to emulate some for loop in python, they have automatic hexadecimal conversion. That is, if you type "0xe" python will spit out 14:

>>> 0xe

So you can do something like:

for i in range(0x1, 0xa) : # do something