Reverse engineering Content- Introduction- Needs- Assembly Language basics- Debuggers
Reverse engineering Introduction- Reverse Engineering is a process of redesigning an existing product to improve and broaden its function, add quality and to increase its useful life. Also and important additional goal is to reduce manufacturing costs of the new product making it competitive in the market place.
Reverse engineering Needs- Reverse engineering is used for testing purpose.- It is used for updating and adding new features.- Migration to another hardware/software platform.- Facilitating software reuse.
Reverse engineering Assembly Language basics- Assembly language is the most basic programming language available for any processor. With assembly language, a programmer works with the operations which are implemented directly on the physical CPU.
Reverse engineering Assembly Language basics- Every code of a software converts in assembly language whether it is written in java or c, or c++ or in any high level language.- Assembly language contains mnimonics for performing an operation like MOV AX, 47104 MOV DS, AX MOV , 36 INT 32
Reverse Engineering Flags- Flags are single bits which indicate the status of something. There are 32 different flags. You will mostly need only 3 of them in reversing. The Z- Flag, the O-Flag and the C-Flag.- A flag can only be 0 or 1, meaning ‘ok or ‘not ok.
Reverse Engineering Segments and offsets- A segment is a piece in memory where instructions (CS), data (DS), stack (SS) or just an extra segment (ES) are stored. Every segment is divided in offsets. In 32-bits applications (Windows 95/98/ME/2000), these offsets are numbered from 00000000 to FFFFFFFF.- A segment is like a page in a book.- And an offset is like a specific line at that page.
Reverse Engineering Registers- Generally 32 bit / 64 bit windows supports mailly 9 registers.- EAX : Extended Accumulator Register- EBX : Base Register- ECX : Counter Register- EDX : Data Register- ESI : Source Index- EDI : Destination Index
Packing & Unpacking Introduction Packing- Packing is a process of protecting the code from the malicious users who use reverse engineering for malicious purpose such as braking security, braking copyrights etc..
Packing & Unpacking Introduction Unpacking- Unpacking is the technique by which one can remove packers or protectors.
Packing & Unpacking Need- Packing is very important to protect the codes.- If a malicious person become successful to brake the packer or protector then he can do normal reverse engineering to brake the code. That’s why its very important to use good protectors/packers.
Packing & Unpacking Objective Unpacking- Packers pack or compress a program much the same way as compressor, packers then attach their own decryption / loading stub which unpacks the program before resuming execution normally at the programs original entry point.
Packing & Unpacking Objective Unpacking- The main objective of unpacking a software is to get the OEP (Original Entry Point) of the software.- Basically when a packer compress the application, the entry point become change to the entry point of packer rather then application.
Packing & Unpacking Objective Unpacking- OEP is refer to the entry point of application.- If one can get the OEP then he can modify the code.
Packing & Unpacking Useful Tools- PEiD detects most common packers, crypters and compilers for PE files. It can currently detect more than 470 different signatures in PE files.- It is useful to get the packer’s name which helps to unpacking because for different packer we have to use different techniques.
Packing & Unpacking PE files- The PE ("portable executable") file format is the format of executable binaries (DLLs and programs) for windows.- It can also be used for object files and libraries.
Reverse Engineering Conclusion- Reverse Engineering is a new research area among software maintenance.- RE includes activities of understanding the system and recovery info from system.- Program understanding is the most important subset of Reverse Engineering.- Discovery of abstraction is key issue.