9 ms·

Reverse Engineering Challenges

103 points by luu 11y ago

TerryADavis 11y ago
Reverse engineering is the biggest humilation there is for an engineer. It's like plagarism in school. You are not good enough to design things, you you have to suck dick. It is a sign of capitalism being flawed. You are not contributing to humanity, just busywork. Encryption has no place in the New World ORder where God talks to everyone and everybody learns that the World is perfectly just. Turn the other cheek makes sense if everybody has a direct phone to God and can ask "why did bad stuff happen?" Nobody will be foolish enough to be a criminal when it is revealed that God's world is perfcetly just. NSA is a bunch of nigger howdy doody dorky ovaltine spooge drinkers.
isido 11y ago
This site and accompanying book (http://beginners.re/Reverse_Engineering_for_Beginners-en.pdf http://beginners.re/Reverse_Engineering_for_Beginners-en.pdf) seem a nice effort. Briefly reading the book, it seems that you need to be an intermediate or advanced beginner, or know something about assembly beforehand. Some terms (opcode, ISA) are not really explained (except in the glossary) before they are used and there are perhaps too much detail in the expense of the bigger picture. Criticisms aside, the book and the challenges seem interesting and the efforts of the author must be appreciated!
- howdoipython 11y ago
  Do you have any recommendations for beginners?
  - isido 11y ago
    I don't remember exactly how I got started, probably by trying to replicate what bigger kids were doing with "intros" and demos. I don't know what would nowadays be a simple enough starting point. But I remember William Stallings' and Andrew Tannebaum's books on operating systems and computer architecture in the university 20 years ago. I don't know if they have been updated, but they might be good starting point, if you need to start from the beginning. On the other hand, if you know basics of how to CPU works, what stack is, know binary and hexadecimal, and some C, you might be able to just read Dennis' book, just ignore things you don't get at first, since many things get explained later in the book, after which you can re-read sections you didn't quite understand first.
    - howdoipython 11y ago
      I'm personally quite slacking in this area. I'll do my best to get more advanced, thanks for the info!
- tptacek 11y ago
  Get past the idea that you need to be advanced to grok assembly language. Assembly is in a lot of ways easier than a lot of higher-level languages. When I was growing up in the early 90s, a lot of my friends started on x86 assembly as a first language --- and x86 is the most annoying instruction set to learn. The right way to learn this stuff is to dive in. You'll be over your head for a few hours, but you'll get your bearings. There are topics this technique doesn't work great with, but assembly reversing isn't one of them. An additional benefit: assembly is one of those things that you might not use all the time in your career (although I've ended up using it quite a bit), but that will nonetheless illuminate lots of other things about computer science. There's a reason Knuth used it as a language to express algorithms in TAOCP. I can sum up the core idea of assembly for you in just a few sentences: * You're given 8-32 global variables of fixed size to work with, called "registers". * Virtually all computation is expressed in terms of simple operations on registers. * Real programs need many more than 8-32 variables to work with. * What doesn't fit in registers lives in memory. * Memory is accessed either with loads and stores at addresses, as if it were a big array, or through PUSH and POP operations on a stack. * Memory is to an assembly program what the disk is to a Ruby program: you pull things out of memory into variables, do things with them, and eventually put them back into memory. * Control flow is done via GOTOs --- jumps, branches, or calls. * A jump is just an unconditional GOTO. * Most operations on registers, like addition and subtraction, have the side effect of altering status flags, like "the last value computed resulted in zero". There are just a few status flags, and they usually live in a special register. * Branches are just GOTOs that are predicated on a status flag, like, "GOTO this address only if the last arithmetic operation resulted in zero". * A CALL is just an unconditional GOTO that pushes the next address on the stack, so a RET instruction can later pop it off and keep going where the CALL left off. Everything else is just a detail. When working with assembly, a lot of people will just get the programmer's reference manual for the instruction set in a PDF (they're published for free). Here's a short one for X86: http://ref.x86asm.net/coder32.html http://ref.x86asm.net/coder32.html Here's ARM: http://infocenter.arm.com/help/topic/com.arm.doc.qrc0001m/QRC0001_UAL.pdf http://infocenter.arm.com/help/topic/com.arm.doc.qrc0001m/QR... Here's AVR: http://www.atmel.com/images/atmel-0856-avr-instruction-set-manual.pdf http://www.atmel.com/images/atmel-0856-avr-instruction-set-m... Even if you'd never written a line of assembly, if I asked you to express the procedures of a simple Ruby program in assembly and gave you the instruction set reference and those sentences, you would figure out how to get the job done in a couple hours. No monads or linear algebra required!
- deaddodo 11y ago
  > Some terms (opcode, ISA) are not really explained (except in the glossary) before they are used and there are perhaps too much detail in the expense of the bigger picture. I feel like if you want to get into serious reverse engineering (beginner or not), you should have a basic understanding of computers. Both of these terms are extremely basic, from that perspective. Opcodes are what Assembly instructions correlate to. ISA just refers to the architecture of the CPU (x86 vs ARM)...e.g. WHAT opcodes/asm applies.
  - isido 11y ago
    I agree. What I meant was that the title "Reverse Engineering for Beginners" might imply that this material would guide the reader from the beginning. Having background in 6502 assembly (thank you, Vic-20!) I didn't have that much trouble in following the presentation in the book. But if coming from higher level programming background and not having basic grasp of how CPUs work, following the text might be difficult.
johnernaut 11y ago
Although probably not well-known, http://crackmes.de/ http://crackmes.de/ is a site I've been using to create / upload and also work on challenges for various RE applications for about 10 years now. I'd definitely recommend it to newcomers wanting to learn more about RE in general.
w23j 11y ago
My Sophos Anti-Virus blocked this site, mentioning a 'Mal/HTMLGen-A' on it.

103 points by luu 11y ago

Reverse engineering is the biggest humilation there is for an engineer. It's like plagarism in school. You are not good enough to design things, you you have to suck dick. It is a sign of capitalism being flawed. You are not contributing to humanity, just busywork. Encryption has no place in the New World ORder where God talks to everyone and everybody learns that the World is perfectly just. Turn the other cheek makes sense if everybody has a direct phone to God and can ask "why did bad stuff happen?" Nobody will be foolish enough to be a criminal when it is revealed that God's world is perfcetly just. NSA is a bunch of nigger howdy doody dorky ovaltine spooge drinkers.

isido 11y ago

This site and accompanying book (http://beginners.re/Reverse_Engineering_for_Beginners-en.pdf http://beginners.re/Reverse_Engineering_for_Beginners-en.pdf) seem a nice effort. Briefly reading the book, it seems that you need to be an intermediate or advanced beginner, or know something about assembly beforehand. Some terms (opcode, ISA) are not really explained (except in the glossary) before they are used and there are perhaps too much detail in the expense of the bigger picture. Criticisms aside, the book and the challenges seem interesting and the efforts of the author must be appreciated!

howdoipython 11y ago
Do you have any recommendations for beginners?
- isido 11y ago
  I don't remember exactly how I got started, probably by trying to replicate what bigger kids were doing with "intros" and demos. I don't know what would nowadays be a simple enough starting point. But I remember William Stallings' and Andrew Tannebaum's books on operating systems and computer architecture in the university 20 years ago. I don't know if they have been updated, but they might be good starting point, if you need to start from the beginning. On the other hand, if you know basics of how to CPU works, what stack is, know binary and hexadecimal, and some C, you might be able to just read Dennis' book, just ignore things you don't get at first, since many things get explained later in the book, after which you can re-read sections you didn't quite understand first.
  - howdoipython 11y ago
    I'm personally quite slacking in this area. I'll do my best to get more advanced, thanks for the info!
tptacek 11y ago
Get past the idea that you need to be advanced to grok assembly language. Assembly is in a lot of ways easier than a lot of higher-level languages. When I was growing up in the early 90s, a lot of my friends started on x86 assembly as a first language --- and x86 is the most annoying instruction set to learn. The right way to learn this stuff is to dive in. You'll be over your head for a few hours, but you'll get your bearings. There are topics this technique doesn't work great with, but assembly reversing isn't one of them. An additional benefit: assembly is one of those things that you might not use all the time in your career (although I've ended up using it quite a bit), but that will nonetheless illuminate lots of other things about computer science. There's a reason Knuth used it as a language to express algorithms in TAOCP. I can sum up the core idea of assembly for you in just a few sentences: * You're given 8-32 global variables of fixed size to work with, called "registers". * Virtually all computation is expressed in terms of simple operations on registers. * Real programs need many more than 8-32 variables to work with. * What doesn't fit in registers lives in memory. * Memory is accessed either with loads and stores at addresses, as if it were a big array, or through PUSH and POP operations on a stack. * Memory is to an assembly program what the disk is to a Ruby program: you pull things out of memory into variables, do things with them, and eventually put them back into memory. * Control flow is done via GOTOs --- jumps, branches, or calls. * A jump is just an unconditional GOTO. * Most operations on registers, like addition and subtraction, have the side effect of altering status flags, like "the last value computed resulted in zero". There are just a few status flags, and they usually live in a special register. * Branches are just GOTOs that are predicated on a status flag, like, "GOTO this address only if the last arithmetic operation resulted in zero". * A CALL is just an unconditional GOTO that pushes the next address on the stack, so a RET instruction can later pop it off and keep going where the CALL left off. Everything else is just a detail. When working with assembly, a lot of people will just get the programmer's reference manual for the instruction set in a PDF (they're published for free). Here's a short one for X86: http://ref.x86asm.net/coder32.html http://ref.x86asm.net/coder32.html Here's ARM: http://infocenter.arm.com/help/topic/com.arm.doc.qrc0001m/QRC0001_UAL.pdf http://infocenter.arm.com/help/topic/com.arm.doc.qrc0001m/QR... Here's AVR: http://www.atmel.com/images/atmel-0856-avr-instruction-set-manual.pdf http://www.atmel.com/images/atmel-0856-avr-instruction-set-m... Even if you'd never written a line of assembly, if I asked you to express the procedures of a simple Ruby program in assembly and gave you the instruction set reference and those sentences, you would figure out how to get the job done in a couple hours. No monads or linear algebra required!
deaddodo 11y ago
> Some terms (opcode, ISA) are not really explained (except in the glossary) before they are used and there are perhaps too much detail in the expense of the bigger picture. I feel like if you want to get into serious reverse engineering (beginner or not), you should have a basic understanding of computers. Both of these terms are extremely basic, from that perspective. Opcodes are what Assembly instructions correlate to. ISA just refers to the architecture of the CPU (x86 vs ARM)...e.g. WHAT opcodes/asm applies.
- isido 11y ago
  I agree. What I meant was that the title "Reverse Engineering for Beginners" might imply that this material would guide the reader from the beginning. Having background in 6502 assembly (thank you, Vic-20!) I didn't have that much trouble in following the presentation in the book. But if coming from higher level programming background and not having basic grasp of how CPUs work, following the text might be difficult.

johnernaut 11y ago

Although probably not well-known, http://crackmes.de/ http://crackmes.de/ is a site I've been using to create / upload and also work on challenges for various RE applications for about 10 years now. I'd definitely recommend it to newcomers wanting to learn more about RE in general.

w23j 11y ago

My Sophos Anti-Virus blocked this site, mentioning a 'Mal/HTMLGen-A' on it.