3 ms·

SoftICE was one of the most amazing utilities out there both for debugging as well as reverse engineering. The Wikipedia page is spot on about WinDbg/KD, but pr

SoftICE was one of the most amazing utilities out there both for debugging as well as reverse engineering. The Wikipedia page is spot on about WinDbg/KD, but pretty out of date re: modern tools. Ollydbg2 came out more than half a decade ago and supports all the 64 bit registers and x86-64 instruction set. Immunity Debugger took the place as the defacto standard, and most modern scripts and tooling are built around Immunity for dynamic analysis and IDA Pro for static analysis. IDA Pro adopted QT natively, so the plugin communities are extending the hell out of what was already a great tool, and there are good plugins that export annotations/symbols that Immunity can consume so the union between static and dynamic analysis has never been smaller. If you don't have an IDA license, Immunity combined with Radare (read down) is still pretty powerful to play around with. Either way, the reverse engineering stuff out there is quite simply amazing. https://github.com/aquynh/capstone https://github.com/aquynh/capstone https://github.com/REhints/HexRaysCodeXplorer https://github.com/REhints/HexRaysCodeXplorer (this is CRAZY useful if you bought the Hex Rays license with IDA) https://github.com/ynvb/DIE https://github.com/ynvb/DIE - makes IDA even better ("DIE is an IDA python plugin designed to enrich IDA`s static analysis with dynamic data) https://portal.cert.org/web/mc-portal/pharos-static-analysis-tools https://portal.cert.org/web/mc-portal/pharos-static-analysis... - I haven't used this yet but Pharos is a static analysis tool out of Carnegie Melon that's particularly useful for C++ gen'd code. https://insights.sei.cmu.edu/sei_blog/2015/08/the-pharos-framework-binary-static-analysis-of-object-oriented-code.html https://insights.sei.cmu.edu/sei_blog/2015/08/the-pharos-fra... Walks through some feature set. HexRays is great for somethings but when you F5 some block, you really are left wanting. This looks like it fills the gap quite nicely. http://www.radare.org/r/cmp.html http://www.radare.org/r/cmp.html - Comparison beween IDA and Radare (admittedly unfair, even titled so, ha) There are dozens of plugins I use which are just python scripts mapped to keyboard shortcuts so I don't even remember what they're called. Someone else is going to have to jump in because I'm not on my work machine and can't look it up. You lost Ring0 with the demise of SoftICE, but the RE community is more active than ever. Just watch a few CCC talks if you're not convinced. Just a note guys: I know you can pirate IDA but some companies just "do it right" and should be supported. I buy from Adafruit even though they're more expensive because I support them. IDA is one dude, who's responsive within the community, who goes out of his way to be nice and implement bug fixes and feature enhancements. I try not to get all preachy, but pirating IDA isn't stealing Visual Studio from Microsoft- you're ripping a dude who's contributed a lot to the community and even offers a free (granted less featureful) version.

mschuster91 11y ago
> IDA is one dude Seriously? One lone guy coded up all of IDA and the Hex Rays decompiler? Whoa, hat off. I always thought that there was a group of more-or-less shady highly experienced hackers, but not a single dude.
- nekitamo 11y ago
  IDA Pro used to be one dude. Right now it's at least 3-4 people.
  - userbinator 11y ago
    One Russian dude, to be precise: https://en.wikipedia.org/wiki/Ilfak_Guilfanov https://en.wikipedia.org/wiki/Ilfak_Guilfanov I don't know if it's just perception bias or something cultural, but I seem to hear a lot more about famous/advanced Russian reverse-engineers than anywhere else.
    - dogma1138 11y ago
      Most likely out of necessity due to the cold war than anything else. When you couldn't import software or hardware really from the west (not that the government would want too) you had to reverse engineer pretty much everything and make it on your own. North Korea used to be quite good in reverse engineering also, now all they do is pretty much hack it the easy way by reskining OSS. Availability was always a big driving force behind many RE efforts, allot of the good reverse engineering examples from the west (EU/US) that you can see especially in the 80's/90's were all about reversing Japanese games and game consoles (including arcade machines), some of them took 10-20 years to break especially those with the more advanced CAPCOM DRM modules.
    - SXX 11y ago
      I think there is a lot of reverse-engineers from CIS you know about it's because once USSR disappear there was a lot of freedom (many would call it anarchy) in copyright area and very limited pressure on illegal activity in internet in general. Basically anyone who had PC and interest in reverse engineering may do almost anything without consequences. There was a lot of people that did it all publicly without really hiding their identity or even making business off it (like well-known DRM-removal tools). If you would try to do anything like that in western would you'll end up in prison soon. Also reverse engineering isn't some independent area, but it's usually linked with black hat security, virus making, carding, SEO, etc. There was a lot of CIS-based illegal and gray area communities and services that only may exist because lack of government control and many still exist. So it's was as well one of ways to make a lot of (illegal) money, but at some point any person grow up, get married (and make a child) and don't want to take criminal risks. Many of them want move to EU/US where risks are higher. Here you go where huge part of experts has come from.

mschuster91 11y ago

> IDA is one dude Seriously? One lone guy coded up all of IDA and the Hex Rays decompiler? Whoa, hat off. I always thought that there was a group of more-or-less shady highly experienced hackers, but not a single dude.

nekitamo 11y ago
IDA Pro used to be one dude. Right now it's at least 3-4 people.
- userbinator 11y ago
  One Russian dude, to be precise: https://en.wikipedia.org/wiki/Ilfak_Guilfanov https://en.wikipedia.org/wiki/Ilfak_Guilfanov I don't know if it's just perception bias or something cultural, but I seem to hear a lot more about famous/advanced Russian reverse-engineers than anywhere else.
  - dogma1138 11y ago
    Most likely out of necessity due to the cold war than anything else. When you couldn't import software or hardware really from the west (not that the government would want too) you had to reverse engineer pretty much everything and make it on your own. North Korea used to be quite good in reverse engineering also, now all they do is pretty much hack it the easy way by reskining OSS. Availability was always a big driving force behind many RE efforts, allot of the good reverse engineering examples from the west (EU/US) that you can see especially in the 80's/90's were all about reversing Japanese games and game consoles (including arcade machines), some of them took 10-20 years to break especially those with the more advanced CAPCOM DRM modules.
  - SXX 11y ago
    I think there is a lot of reverse-engineers from CIS you know about it's because once USSR disappear there was a lot of freedom (many would call it anarchy) in copyright area and very limited pressure on illegal activity in internet in general. Basically anyone who had PC and interest in reverse engineering may do almost anything without consequences. There was a lot of people that did it all publicly without really hiding their identity or even making business off it (like well-known DRM-removal tools). If you would try to do anything like that in western would you'll end up in prison soon. Also reverse engineering isn't some independent area, but it's usually linked with black hat security, virus making, carding, SEO, etc. There was a lot of CIS-based illegal and gray area communities and services that only may exist because lack of government control and many still exist. So it's was as well one of ways to make a lot of (illegal) money, but at some point any person grow up, get married (and make a child) and don't want to take criminal risks. Many of them want move to EU/US where risks are higher. Here you go where huge part of experts has come from.