Introduction to reverse engineering

1. Finding secrets using
Reverse engineering
By Japneet Singh

2. Why reverse engineer?
• Security researchers use it to
• Understand and defend against malware
• Find vulnerabilities as part of pen testing
• Malware authors use it to
• Find bypasses in security software
• Find vulnerabilities to abuse
• IP theft

3. x64 General purpose register set
Accumulator
Base
Counter
Data
Stack Base pointer
Source Index
Destination Index
Stack Pointer
Auxiliary

4. x64 Calling convention
• First 4 arguments in registers, rest on the stack
void func(arg1, arg2, arg3, arg4, arg5, …)
RCX RDX R8 R9
Stack

5. Few instructions
• Arithmetic – ADD, SUB, IMUL, DIV, INC, DEC
• Stack – PUSH, POP
• Memory – MOV, LEA
• Branching – JMP, JZ, JNZ, JGE, JLE, …
• Functions – CALL
• Logical – XOR, AND, OR, NOT

6. IDA
• Popular RE tool for binaries
• Supports many different binary formats and CPU architectures
• Quite user friendly
• Expensive license!
• Alternatives
• Binary Ninja
• Ghidra

7. Warming up!
• Lab 1 – Hello world
• Lab 2 – Simple arithmetic
• Lab 3 – Branching
• Lab 4 – Loops

8. Fun!
• Lab 5 – Secret passcode
• Lab 6 – Another secret passcode
• Lab 7 – Binary patching

9. FLIRT signatures
• Used to find what part of code belongs to known libraries
• Very important role!

10. Q & A