Upload File

introduction to reverse engineering

prev
next
out of 30
Download Introduction to Reverse Engineering

Upload: gpskumar22

Post on 13-Oct-2015

31 views

Category:

Documents


0 download

Report

DESCRIPTION

1

TRANSCRIPT

  • Introduction to Reverse EngineeringGergely ErdlyiResearch Manager

  • February 02, 09 Page

    Agenda

    Reverse Engineering Intro Ethical and Legal Aspects Process of Reverse Engineering Tools of the Trade

  • February 02, 09 Page

    What is Reverse Engineering? 1/2

  • February 02, 09 Page

    What is Reverse Engineering? 1/2

    Image Copyright 2005 BAE Systems

  • February 02, 09 Page

    What is Reverse Engineering? 1/2

    Image Copyright 2005 BAE Systems Image Copyright 2005 BAE Systems

  • February 02, 09 Page

    What is Reverse Engineering? 2/2

    Image Copyright 2005 BAE Systems

  • February 02, 09 Page

    Reverse Code Engineering

    Reverse Engineering is also known as RE or RCE RE: Reverse Engineering RCE: Reverse Code Engineering

    RE is the process of understanding an existing product Malware analysis and security research often involves RE

  • February 02, 09 Page

    Compilation Process

    Source Code Object File Executable

    Compilation Linking

    Human readable

    text file

    Binary code with

    readable symbols

    Binary code with

    no symbols

    Code Readability

  • February 02, 09 Page

    Compilation Results

  • February 02, 09 Page

    Compilation Results

    int ExecFile(char *FileName){ PyObject* PyFileObject = PyFile_FromString(FileName, "r"); if (!PyFileObject) { return 0; } if (PyRun_SimpleFile(PyFile_AsFile(PyFileObject), FileName) == 0) { Py_DECREF(PyFileObject); return 1; } else { Py_DECREF(PyFileObject); return 0; }}

  • February 02, 09 Page

    Compilation Results

    int ExecFile(char *FileName){ PyObject* PyFileObject = PyFile_FromString(FileName, "r"); if (!PyFileObject) { return 0; } if (PyRun_SimpleFile(PyFile_AsFile(PyFileObject), FileName) == 0) { Py_DECREF(PyFileObject); return 1; } else { Py_DECREF(PyFileObject); return 0; }}

    .text:00401250 E8 BB DA 0E 00 89 44 24 04 A1 2C A3 57 00 8B 40 F++a.D$ ,W.@

    .text:00401260 10 89 04 24 E8 27 D5 0E 00 8B 15 2C A3 57 00 E9 $F'+a.,W.T

    .text:00401270 4B FF FF FF 8D B6 00 00 00 00 8D BF 00 00 00 00 K....+....

    .text:00401280 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 18 Us8 $ ...

    .text:00401290 A3 57 00 E8 B8 FE FF FF 90 8D B4 26 00 00 00 00 W.F+&....

    .text:004012A0 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 18 Us8 $ ...

    .text:004012B0 A3 57 00 E8 98 FE FF FF 90 8D B4 26 00 00 00 00 W.F&....

    .text:004012C0 55 8B 0D 54 A3 57 00 89 E5 5D FF E1 8D 74 26 00 UTW.s]t&.

    .text:004012D0 55 8B 0D 34 A3 57 00 89 E5 5D FF E1 90 90 90 90 U4W.s]

    .text:004012E0 83 EC 7C B8 70 B5 4E 00 89 44 24 34 B8 74 30 4F 8|+pN.D$4+t0O

    .text:004012F0 00 89 44 24 38 8D 44 24 60 89 44 24 3C B8 90 13 .D$8D$`D$

  • February 02, 09 Page

    Uses of Reverse Engineering

    Malware analysis Security / vulnerability research Driver development Compatibility fixes Legacy application support

  • February 02, 09 Page

    Ethical and Legal Aspects

    Image: Public Domain

    Disclaimer: I am not a lawyer, but here we go

  • February 02, 09 Page

    Ethical and Legal Aspects

    Legality of reverse engineering is governed by copyright laws Copyright laws differ from country to country Reverse engineering is legal only is few specific cases Black box testing does not constitute reverse engineering Reverse engineering for compatibility fixes is legal Reverse engineering spyware is illegal in most countries When in doubt, do not reverse engineer!

  • February 02, 09 Page

    Legal Uses of Reverse Engineering

    Recovery of own lost source code Recovery of data from legacy formats Malware analysis and research Security and vulnerability research Copyright infringement investigations Finding out the contents of any database you legally purchased

  • February 02, 09 Page

    Illegal Activities

    Image Copyright 2005 Klaus with K

  • February 02, 09 Page

    Illegal Activities

    Illegal to reverse engineer and sell a competing product Illegal to crack copy protections Illegal to distribute a crack/registration for copyrighted software Illegal to gain unauthorized access to any computer system Copyright protected software is off-limits in most cases Spyware/Adware with companies behind them are included

  • February 02, 09 Page

    Decompilation Process

    Executable Disassembly Source Code

    Disassembly Decompilation

    Reverse engineer

    readable code

    Binary code with

    no symbols

    Code Readability

    Human

    readable code

  • February 02, 09 Page

    Disassembly Results

  • February 02, 09 Page

    .text:00401250 E8 BB DA 0E 00 89 44 24 04 A1 2C A3 57 00 8B 40 F++a.D$ ,W.@

    .text:00401260 10 89 04 24 E8 27 D5 0E 00 8B 15 2C A3 57 00 E9 $F'+a.,W.T

    .text:00401270 4B FF FF FF 8D B6 00 00 00 00 8D BF 00 00 00 00 K....+....

    .text:00401280 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 18 Us8 $ ...

    .text:00401290 A3 57 00 E8 B8 FE FF FF 90 8D B4 26 00 00 00 00 W.F+&....

    .text:004012A0 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 18 Us8 $ ...

    .text:004012B0 A3 57 00 E8 98 FE FF FF 90 8D B4 26 00 00 00 00 W.F&....

    .text:004012C0 55 8B 0D 54 A3 57 00 89 E5 5D FF E1 8D 74 26 00 UTW.s]t&.

    .text:004012D0 55 8B 0D 34 A3 57 00 89 E5 5D FF E1 90 90 90 90 U4W.s]

    .text:004012E0 83 EC 7C B8 70 B5 4E 00 89 44 24 34 B8 74 30 4F 8|+pN.D$4+t0O

    .text:004012F0 00 89 44 24 38 8D 44 24 60 89 44 24 3C B8 90 13 .D$8D$`D$

  • February 02, 09 Page

    .text:00401250 E8 BB DA 0E 00 89 44 24 04 A1 2C A3 57 00 8B 40 F++a.D$ ,W.@

    .text:00401260 10 89 04 24 E8 27 D5 0E 00 8B 15 2C A3 57 00 E9 $F'+a.,W.T

    .text:00401270 4B FF FF FF 8D B6 00 00 00 00 8D BF 00 00 00 00 K....+....

    .text:00401280 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 18 Us8 $ ...

    .text:00401290 A3 57 00 E8 B8 FE FF FF 90 8D B4 26 00 00 00 00 W.F+&....

    .text:004012A0 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 18 Us8 $ ...

    .text:004012B0 A3 57 00 E8 98 FE FF FF 90 8D B4 26 00 00 00 00 W.F&....

    .text:004012C0 55 8B 0D 54 A3 57 00 89 E5 5D FF E1 8D 74 26 00 UTW.s]t&.

    .text:004012D0 55 8B 0D 34 A3 57 00 89 E5 5D FF E1 90 90 90 90 U4W.s]

    .text:004012E0 83 EC 7C B8 70 B5 4E 00 89 44 24 34 B8 74 30 4F 8|+pN.D$4+t0O

    .text:004012F0 00 89 44 24 38 8D 44 24 60 89 44 24 3C B8 90 13 .D$8D$`D$

  • February 02, 09 Page

  • February 02, 09 Page

    Required Skills

    General computer architecture knowledge Assembly programming of target processors Operating systems File formats Information search skills ...real persistence...

  • February 02, 09 Page

    Most Commonly Used Tools

    Hex editor/viewer Disassembler Search engine Debugger Script language

  • February 02, 09 Page

    Most Commonly Used Tools

    Hex editor/viewer Disassembler Search engine Debugger Script language

  • February 02, 09 Page

    Most Commonly Used Tools

    Hex editor/viewer Disassembler Search engine Debugger Script language

  • February 02, 09 Page

    Most Commonly Used Tools

    Hex editor/viewer Disassembler Search engine Debugger Script language

  • February 02, 09 Page

    Most Commonly Used Tools

    Hex editor/viewer Disassembler Search engine Debugger Script language

  • February 02, 09 Page

    Most Commonly Used Tools

    Hex editor/viewer Disassembler Search engine Debugger Script language

  • February 02, 09 Page

    Getting Started

    Master your tools Identify the target binary format Identify the target processor Identify the target operating system dig in and find out as much as you can


Introduction To IoT Reverse Engineering

Cryptanalysis, Reverse-Engineering and Design of Symmetric ... · S-Box Reverse-Engineering Outline 1 Introduction 2 Lightweight Cryptography 3 S-Box Reverse-Engineering 4 Conclusion

Introduction to Reverse Engineering · Protecting the irreplaceable | f-secure.com Introduction to Reverse Engineering Gergely Erdélyi – Senior Manager, Anti-malware Research

Introduction to video reverse engineering · Introduction to video reverse engineering Vittorio Giovara Brussels 2016-01-29 FOSDEM - Open Media CC-BY-SA 1

Julio Auto Practical (Introduction to) Reverse Engineering

«Introduction to malware reverse engineering» by Sergey Kharyuk aka ximerus

Software Engineering Education and Reverse Engineering · Introduction 16 th Workshop Software Engineering Education and Reverse Engineering . Jahorina, BiH. 22 nd – 26 th August

Reverse-Engineering of Hardware Circuits-0mm · Introduction Invasive techniques Semi-invasive techniques Non-invasive techniques Countermeasures against RE Goal of reverse-engineering

EDSGN 100: INTRODUCTION TO ENGINEERING …php.scripts.psu.edu/users/c/b/cbl5289/edsgn100_su16_section2016...EDSGN 100: INTRODUCTION TO ENGINEERING DESIGN ... reverse. 10 Engineering

EECS 354 Network Security Reverse Engineering. Introduction Preventing Reverse Engineering Reversing High Level Languages Reversing an ELF Executable

INFO 330 Reverse Engineering Activity Introduction and Instructions

Reverse engineering introduction

We will start with a short introduction to reverse engineering and … · 2019-06-16 · "Reverse engineering" is the same "engineering" process, but done in reverse order and, usually,

Reverse Engineering Introduction to Computer Security CSC 405Introduction to Computer Security Reverse Engineering Alexandros Kapravelos [email protected] ... • set when operation

Reverse Engineering: An Introduction. What is Reverse Engineering? A systematic methodology for analyzing the design of an existing device or system,

A Proposed Framework for Agile Reverse Engineering · A Proposed Framework for Agile Reverse Engineering ... Digitization, Coordinate Measuring Machine 1 Introduction ... approach

Reverse Engineering _An Introduction

SRE Introduction 1 Software Reverse Engineering (SRE)

Introduction to Malware Detection and Reverse Engineering

Course Introduction & Logistics · 2013. 6. 25. · Reverse Engineering Malware, Spring 2013 Antti Tikkanen, F-Secure Corporation Course Introduction & Logistics . Reverse Engineering

Introduction to video reverse engineering

«Introduction to malware reverse engineering» by Sergey Kharyuk

Reverse Engineering archeology: Reverse engineering

Introduction of Reverse Engineering

CPE 323 Introduction to Software Reverse Engineering in ...lacasa.uah.edu/portal/Upload/teaching/cpe323/lectures/lw...engineering, but here we are focusing on software reverse engineering

Quick Introduction to Reverse Engineering for Beginners --Dennis Yurichev

Reverse Engineering of Biomedical Elaborated Signal-Introduction

Reverse Engineering - agz.esagz.es/Reverse-Engineering/Basic/Reverse Engineering [Security... · © 2008 Security Awareness Korea - i - Reverse Engineering Table of Content Module

Practical ( Introduction to) Reverse Engineering

Reverse Engineering Tool Based on Unified Mapping Method ... · 4D Reverse Engineering Tool. Keywords Reverse Engineering, Imagix-4D Reverse Engineering Tool, Class Diagram 1. Introduction

AOE IED Integrated Unit: Reverse Engineering Lesson 1 ... · Unit 2 Reverse Engineering Lesson 1 Introduction to Reverse Engineering Lesson Steps Step Min. Activity CLASS PERIOD 1

Introduction to Reverse Engineering · Introduction to Reverse Engineering Gergely Erdélyi Research Manager. February 02, 09 Page Agenda • Reverse Engineering Intro • Ethical

Introduction to Reverse Engineering - Securimag

Reverse-engineering in spiking neural networks parameters ... · Reverse-engineering in spiking neural networks parameters: exact deterministic parameters estimation3 1 Introduction

Reverse JTAG Pierre Surply Reverse engineering AT32UC3A’s JTAG · Reverse engineering AT32UC3A’s JTAG Pierre Surply Introduction Overview TAP Controller Scan Chain Boundary Scan