6 ms·

Cutter is "A Qt and C++ GUI for radare2". There are more alternatives to IDA Pro. Hopper Disassembler is one. Binary Ninja (binja) is another. Here is an inde

Cutter is "A Qt and C++ GUI for radare2". There are more alternatives to IDA Pro. Hopper Disassembler is one. Binary Ninja (binja) is another. Here is an independent review of Binary Ninja: https://www.trailofbits.com/research-and-development/binja/ https://www.trailofbits.com/research-and-development/binja/ Here is the project itself: https://binary.ninja/ https://binary.ninja/ I happen to know most of the people involved in Binary Ninja. They do great work. They really understand security and the need to operate off-line. BTW, if disassembly is a career interest for you, see https://news.ycombinator.com/item?id=17208556 https://news.ycombinator.com/item?id=17208556 for my "Ask HN: Who is hiring? (June 2018)" comment.

voltagex_ 8y ago
Reverse engineering has been a constant interest for me but I've never managed to get it to "click" for me. I don't particularly need the skill, but it's one I'd like to have (at least to the extent of being able to do simple crackmes).
- veganjay 8y ago
  It's a tricky art. It's helpful to learn some of the basics such as how variables are passed to a function on the stack for x86 or as registers with x64. Beyond that it takes practice. Things that have helped me are writing c code and dissassembling it, stepping through code with GDB and working on crackmes and CTFs. For radare2 in particular, this tutorial was helpful: https://leotindall.com/tutorial/an-intro-to-x86_64-reverse-engineering/ https://leotindall.com/tutorial/an-intro-to-x86_64-reverse-e...
  - crankybear1337 8y ago
    Yeah, writing simple C programs using various constructs (switch/if/for statements, structs, different APIs, etc.) and then looking at the produced assembly is a good way to learn. Another thing I like to do is to rewrite complex parts of the disassembly in pseudo-C (though radare has an option to do this automatically), which makes the overall logic easier to see (and is, of course, the entire point of decompilers like Hex-Rays).
    - souprock 8y ago
      This works. Be sure to try different compilers and optimization levels. You can become a better programmer this way. You start to get a real feel for what the compiler can and can't optimize. For example, you can see how a do...while loop is usually the best kind of loop, but without seeing the assembly you might assume they are all the same.
- bitexploder 8y ago
  Play the microcorruption CTF. Things should make a lot more sense when you drop away the complexity of bigger archs.
- stevekemp 8y ago
  My earliest exposure to computers was the ZX Spectrum, an 8-bit home-computer from the 80s, which was insanely populare in the UK. Having few games, and little budget for more, most of the kids around would swap home-copied games. I used to have fun removing protection, or hacking the games for infinite lives. At the time I was 12-15 and it was very much a case of trial or error. Assuming a game started with 3 lives I would look for every occurance of "LD A,3", and change the 3 to 5. If that didn't work I'd eventually replace every occurance of 3 with a different number. As you can imagine this was a tedious process! If I was lucky enough to find the right "starting value" I'd then go on to look which memory-address the value was saved in. That would then let me search for that same address in the rest of the program, and hopefully spot something like: LD A,(addr) DEC A LD (addr),A At that point I was done. Removing the decrement would stop the lives-counter from being decreased - giving you as many as you wanted. Later I moved to the PC, and I found +fravia's site very educational. There are still mirrors which show how you could remove protection from commercial software - and oftentimes I'd be reminded of my previous attempts. Sometimes it is very simple, and sometimes not. Educational regardless. Random mirror here - http://acrigs.com/FRAVIA/aca400.htm http://acrigs.com/FRAVIA/aca400.htm The main reason I stopped this work? Few programs on Linux prompt you for license keys! But a good disassembler is a worthwhile thing to explore, whether for debugging your own code, or randomly exploring crackmes.
  - busterarm 8y ago
    Random aside: I'm constantly impressed by the output of the HCU folks and sorely wish that both the community around HCU and +Fravia were still around.
  - jrumbut 8y ago
    My enjoyment of fravia's philosophizing led me to try my hand at the crackmes and other stuff. I could get a few but never really got the hang of it, it was a great educational exercise. I highly recommend anyone who's interested (particularly people who don't remember a pre-Google, pre-Facebook internet) in bold (and crazy) ideas about technology reading his work. Edit: I suppose many if not most of the essays aren't strictly "pre-Google" but they are from its much earlier days when it was a very different service.
veganjay 8y ago
+1 for Hopper and BinaryNinja. Radare2 by itself has a small learning curve, but it is well worth it. It's usually the first dissassembler I turn to. Also helpful for dynamic analysis is GDB +PEDA. For some good intros for binary exploitation, see live overflows videos on YouTube.
- voltagex_ 8y ago
  I was given a short intro to GDB, +1 for PEDA making it a lot easier to understand (or at least, giving you enough context to know what's happening at a particular moment)
49bc 8y ago
Ugh I read your job post months ago and I’m so interested in what you’re doing. I’m not aligned in any of the skills, just really interested about the actual work. What can you share?
rescbr 8y ago
Loved the job description, but me not being an US citizen is a no-go, unfortunately.
zerr 8y ago
> Citizenship is a job requirement. Do you do disassembly for government?
- souprock 8y ago
  as a contractor
  - zerr 8y ago
    Interesting, so even if e.g. only one team works for gov projects, is it anyway required that the whole company consists of citizens?
busterarm 8y ago
> BTW, if disassembly is a career interest for you, see https://news.ycombinator.com/item?id=17208556 https://news.ycombinator.com/item?id=17208556 for my "Ask HN: Who is hiring? (June 2018)" comment. You're doing "God's Work". I wish I was even remotely qualified to do this sorta thing because I'm pretty interested in it, but I'm pretty far removed from it (large scale infrastructure architecture). Do you mind if I email you some questions as far as good ways to start tracking in that direction? (though you pretty much enumerated them in the transferable skills part)
inferiorhuman 8y ago
> There are more alternatives to IDA Pro. Hopper Disassembler is one. Binary Ninja (binja) is another. Sure, but radare2 is open source which cuts both ways I suppose. IDA feels significantly more polished than r2, but I've had fun implementing a not-so-common-anymore architecture as a set of r2 plugins. There's also the free version of IDA (x86 only though).
- davrosthedalek 8y ago
  I think the new free version of IDA also supports x86_64 now.
  - heinrich5991 8y ago
    https://www.hex-rays.com/products/ida/order.shtml https://www.hex-rays.com/products/ida/order.shtml >IDA Starter: supports more than 20 processor families, including the popular x86 and ARM processors. >IDA Starter does not support 64-bit files. Doesn't look like it does.
    - guitmz 8y ago
      IDA Freeware version 7 has the following limitations: 1. Only for non-commercial use 2. Without technical support 3. Only supports x64 code It DOES support x64. I am using it. You can download it at: https://www.hex-rays.com/products/ida/support/download_freeware.shtml https://www.hex-rays.com/products/ida/support/download_freew...
deleted 8y ago
[deleted]

voltagex_ 8y ago

Reverse engineering has been a constant interest for me but I've never managed to get it to "click" for me. I don't particularly need the skill, but it's one I'd like to have (at least to the extent of being able to do simple crackmes).

veganjay 8y ago
It's a tricky art. It's helpful to learn some of the basics such as how variables are passed to a function on the stack for x86 or as registers with x64. Beyond that it takes practice. Things that have helped me are writing c code and dissassembling it, stepping through code with GDB and working on crackmes and CTFs. For radare2 in particular, this tutorial was helpful: https://leotindall.com/tutorial/an-intro-to-x86_64-reverse-engineering/ https://leotindall.com/tutorial/an-intro-to-x86_64-reverse-e...
- crankybear1337 8y ago
  Yeah, writing simple C programs using various constructs (switch/if/for statements, structs, different APIs, etc.) and then looking at the produced assembly is a good way to learn. Another thing I like to do is to rewrite complex parts of the disassembly in pseudo-C (though radare has an option to do this automatically), which makes the overall logic easier to see (and is, of course, the entire point of decompilers like Hex-Rays).
  - souprock 8y ago
    This works. Be sure to try different compilers and optimization levels. You can become a better programmer this way. You start to get a real feel for what the compiler can and can't optimize. For example, you can see how a do...while loop is usually the best kind of loop, but without seeing the assembly you might assume they are all the same.
bitexploder 8y ago
Play the microcorruption CTF. Things should make a lot more sense when you drop away the complexity of bigger archs.
stevekemp 8y ago
My earliest exposure to computers was the ZX Spectrum, an 8-bit home-computer from the 80s, which was insanely populare in the UK. Having few games, and little budget for more, most of the kids around would swap home-copied games. I used to have fun removing protection, or hacking the games for infinite lives. At the time I was 12-15 and it was very much a case of trial or error. Assuming a game started with 3 lives I would look for every occurance of "LD A,3", and change the 3 to 5. If that didn't work I'd eventually replace every occurance of 3 with a different number. As you can imagine this was a tedious process! If I was lucky enough to find the right "starting value" I'd then go on to look which memory-address the value was saved in. That would then let me search for that same address in the rest of the program, and hopefully spot something like: LD A,(addr) DEC A LD (addr),A At that point I was done. Removing the decrement would stop the lives-counter from being decreased - giving you as many as you wanted. Later I moved to the PC, and I found +fravia's site very educational. There are still mirrors which show how you could remove protection from commercial software - and oftentimes I'd be reminded of my previous attempts. Sometimes it is very simple, and sometimes not. Educational regardless. Random mirror here - http://acrigs.com/FRAVIA/aca400.htm http://acrigs.com/FRAVIA/aca400.htm The main reason I stopped this work? Few programs on Linux prompt you for license keys! But a good disassembler is a worthwhile thing to explore, whether for debugging your own code, or randomly exploring crackmes.
- busterarm 8y ago
  Random aside: I'm constantly impressed by the output of the HCU folks and sorely wish that both the community around HCU and +Fravia were still around.
- jrumbut 8y ago
  My enjoyment of fravia's philosophizing led me to try my hand at the crackmes and other stuff. I could get a few but never really got the hang of it, it was a great educational exercise. I highly recommend anyone who's interested (particularly people who don't remember a pre-Google, pre-Facebook internet) in bold (and crazy) ideas about technology reading his work. Edit: I suppose many if not most of the essays aren't strictly "pre-Google" but they are from its much earlier days when it was a very different service.

veganjay 8y ago

+1 for Hopper and BinaryNinja. Radare2 by itself has a small learning curve, but it is well worth it. It's usually the first dissassembler I turn to. Also helpful for dynamic analysis is GDB +PEDA. For some good intros for binary exploitation, see live overflows videos on YouTube.

voltagex_ 8y ago
I was given a short intro to GDB, +1 for PEDA making it a lot easier to understand (or at least, giving you enough context to know what's happening at a particular moment)

49bc 8y ago

Ugh I read your job post months ago and I’m so interested in what you’re doing. I’m not aligned in any of the skills, just really interested about the actual work. What can you share?

rescbr 8y ago

Loved the job description, but me not being an US citizen is a no-go, unfortunately.

zerr 8y ago

> Citizenship is a job requirement. Do you do disassembly for government?

souprock 8y ago
as a contractor
- zerr 8y ago
  Interesting, so even if e.g. only one team works for gov projects, is it anyway required that the whole company consists of citizens?

busterarm 8y ago

> BTW, if disassembly is a career interest for you, see https://news.ycombinator.com/item?id=17208556 https://news.ycombinator.com/item?id=17208556 for my "Ask HN: Who is hiring? (June 2018)" comment. You're doing "God's Work". I wish I was even remotely qualified to do this sorta thing because I'm pretty interested in it, but I'm pretty far removed from it (large scale infrastructure architecture). Do you mind if I email you some questions as far as good ways to start tracking in that direction? (though you pretty much enumerated them in the transferable skills part)

inferiorhuman 8y ago

> There are more alternatives to IDA Pro. Hopper Disassembler is one. Binary Ninja (binja) is another. Sure, but radare2 is open source which cuts both ways I suppose. IDA feels significantly more polished than r2, but I've had fun implementing a not-so-common-anymore architecture as a set of r2 plugins. There's also the free version of IDA (x86 only though).

davrosthedalek 8y ago
I think the new free version of IDA also supports x86_64 now.
- heinrich5991 8y ago
  https://www.hex-rays.com/products/ida/order.shtml https://www.hex-rays.com/products/ida/order.shtml >IDA Starter: supports more than 20 processor families, including the popular x86 and ARM processors. >IDA Starter does not support 64-bit files. Doesn't look like it does.
  - guitmz 8y ago
    IDA Freeware version 7 has the following limitations: 1. Only for non-commercial use 2. Without technical support 3. Only supports x64 code It DOES support x64. I am using it. You can download it at: https://www.hex-rays.com/products/ida/support/download_freeware.shtml https://www.hex-rays.com/products/ida/support/download_freew...

deleted 8y ago

[deleted]