7 ms·

Some decompiling, reverse engineering, and keygen tutorials

178 points by sgloutnikov 14y ago

lakeeffect 14y ago
I love the idea of this, but the fact that I have to download something scares the hell out of me.
- michaelrbock 14y ago
  this
- srbucsh 14y ago
  I've got a virtual-box VM dedicated to this kind of thing. Install all your tools first from trusted sources, freeze that image and go wild.
  - jdotjdot 14y ago
    Have you ever looked at Sandboxie? I like it, but it's probably not as secure as a VM.
    - vidyesh 14y ago
      That looks interesting, are you using it? Is it as safe as it looks?
      - socillion 14y ago
        yeah, I haven't had any problems using it to run various programs completely sandboxed.
      - jdotjdot 14y ago
        I've used it for years and I like it. However, I'm not prepared to make any statements about how safe it actually is. I don't have quite deep enough security expertise to know that.
- alok-g 14y ago
  Especially when the download also includes *.exe files like in this case.
kaoD 14y ago
Brings old memories to me :) I used to do reverse engineering when I was a teenager, just for the fun. It made me feel powerful in a certain way. RE is a great mind puzzler! It builds lots of skills: I learnt a lot of ASM, how OSes worked on the inside, compilers, problem solving...
ikkyu 14y ago
Good tutorials but how is this news?
- joshschreuder 14y ago
  What to Submit On-Topic: Anything that good hackers would find interesting. That includes more than hacking and startups. If you had to reduce it to a sentence, the answer might be: anything that gratifies one's intellectual curiosity. From: http://ycombinator.com/newsguidelines.html http://ycombinator.com/newsguidelines.html
samsaga2 14y ago
The number three has a nice virus file (W32.Drop:Banker.15ja.1201).
- user1251 14y ago
  No, your antivirus software has a False Positive. I hate people that trust to AV without any attempts to use their brain. If your AV say to you 'JUMP TO WINDOW' - will you do it?
  - rivd 14y ago
    you _hate_ them? wow. anyway, i would also not jump out of the window, because some anonymous commenter says its not dangerous to do so.
just2n 14y ago
Ahh. This brings back my memories of my teen years of reverse engineering. I enjoyed it so much I almost decided to go into malware analysis. Breaking crackmes, reversemes, spending hours writing code in C and dissecting what compilers came up with at all levels of optimization. Finding packers/protectors and figuring out how to remove them by hand and then building an olly script that would do it automatically. Cracking all the software you own (legally) just because. Back when CD cracks were still needed, I actually made my own, and it felt great. I did all of my hacking on a Windows machine but now I use OSX almost exclusively. Does anyone know of roughly equivalent tools in this world? Maybe I'll take up the hobby again.
- zyb09 14y ago
  Check out IDA Pro, I think it's the go to tool for reverse engineering on all platforms now. Haven't been looking into it for a while though.
  - adr_ 14y ago
    For a mere US$1129...
    - Auguste 14y ago
      Given the nature of the hobby, I get the feeling that few people have paid for it. That said, the older IDA Pro 5.0 has been released as freeware: https://www.hex-rays.com/products/ida/support/download_freeware.shtml https://www.hex-rays.com/products/ida/support/download_freew...
    - zorlem 14y ago
      Given the maturity of the tool, the breadth of functionality, plugins, scriptability, etc. these are petty money for what IDA Pro has to offer to a professional that has to do Reverse Engineering for a living. I do agree that for a tool used for a hobby it is expensive, but for hobbyists there are other, simpler tools that could be used.
      - 14y ago
jasim 14y ago
As a kid fumbling around proprietary Windows binaries, I felt liberated by the ideas of Fravia and +ORC. They taught me that I deserve to know what goes on underneath the software I use. Softice, IDA and w32dasm were the tools of the trade. But most of it were limited to finding where the MessageBox with the trial message pops up and reversing the conditional jump just before it. Here is a small tutorial teaching how to reverse and remove the trial limitation of an ancient version of UltraEdit : http://71.6.196.237/fravia/uedilas.htm http://71.6.196.237/fravia/uedilas.htm But after switching to a fully opensource stack, reverse engineering lost its charm. Understanding how things work is taken for granted and I can't imagine going back to an opaque proprietary environment. Fravia passed away on 2009; but his archives are preserved here: http://71.6.196.237/fravia/index.htm http://71.6.196.237/fravia/index.htm
- duiker101 14y ago
  may I ask what is your fully opensource stack?
  - adr_ 14y ago
    This is a bad answer, but when I'm on Linux, I use objdump and gdb for most of my reversing. They don't really compare to IDA, though. xxd is fine for hex editing, especially in the context of simple conditional jump changing, although there are much better open source hex editors.
- zorlem 14y ago
  What you link to is Fravia+ previous project, more focused on software reverse engineering - http://www.woodmann.com/fravia/ http://www.woodmann.com/fravia/. Fravia+'s last project - "Web Searchlores" was/is more aimed towards general reverse engineering and information searching. The site contains a huge collection of information, which curiously, although not updated for so many years, is still relevant today.pparently searchlores.org and fravia.com have expired and are "parked" by sombody. But looks like http://search.lores.eu/ http://search.lores.eu/ is the only remaining official mirror that remains from What you say about the F/OSS certainly rings true, but at least for me, software reverse engineering has always been more as a training ground for reversing in general than to cracking software copy protections. +greythorne has stopped updating his pages and +HCU's Linux infor, but mammon_ is pretty active, and even moved to Github: http://mammon.github.io/ http://mammon.github.io/ . Definitely worth checking out for more information about Software RE under GNU/Linux. Nowadays there are a lot of opaque software in widespread use, so the main focus has shifted towards web platforms, where reversing is still applicable. edit: style
grn 14y ago
You can also have some fun by doing crackmes at http://www.crackmes.de http://www.crackmes.de. Many crackmes require considerable technical and analytical skills. They also enable you to learn the underlying platform better.
mdaniel 14y ago
For all the comments about crackmes and patching around messageboxes, I would like to mention that reverse engineering is arguably more valuable for its ability to surface file format information and/or protocol specifics. In several countries, this is one of the expressly granted rights with respect to reverse engineering since it promotes interoperability and (more often than not) allows one to use a file format (or network service) long after the original software has expired [in the mortality sense]. I also highly recommend checking out the new http://reverseengineering.stackexchange.com/ http://reverseengineering.stackexchange.com/ since it is currently in its beta period and needs all the content it can get.

178 points by sgloutnikov 14y ago

lakeeffect 14y ago

I love the idea of this, but the fact that I have to download something scares the hell out of me.

michaelrbock 14y ago
this
srbucsh 14y ago
I've got a virtual-box VM dedicated to this kind of thing. Install all your tools first from trusted sources, freeze that image and go wild.
- jdotjdot 14y ago
  Have you ever looked at Sandboxie? I like it, but it's probably not as secure as a VM.
  - vidyesh 14y ago
    That looks interesting, are you using it? Is it as safe as it looks?
    - socillion 14y ago
      yeah, I haven't had any problems using it to run various programs completely sandboxed.
    - jdotjdot 14y ago
      I've used it for years and I like it. However, I'm not prepared to make any statements about how safe it actually is. I don't have quite deep enough security expertise to know that.
alok-g 14y ago
Especially when the download also includes *.exe files like in this case.

kaoD 14y ago

Brings old memories to me :) I used to do reverse engineering when I was a teenager, just for the fun. It made me feel powerful in a certain way. RE is a great mind puzzler! It builds lots of skills: I learnt a lot of ASM, how OSes worked on the inside, compilers, problem solving...

ikkyu 14y ago

Good tutorials but how is this news?

joshschreuder 14y ago
What to Submit On-Topic: Anything that good hackers would find interesting. That includes more than hacking and startups. If you had to reduce it to a sentence, the answer might be: anything that gratifies one's intellectual curiosity. From: http://ycombinator.com/newsguidelines.html http://ycombinator.com/newsguidelines.html

samsaga2 14y ago

The number three has a nice virus file (W32.Drop:Banker.15ja.1201).

user1251 14y ago
No, your antivirus software has a False Positive. I hate people that trust to AV without any attempts to use their brain. If your AV say to you 'JUMP TO WINDOW' - will you do it?
- rivd 14y ago
  you _hate_ them? wow. anyway, i would also not jump out of the window, because some anonymous commenter says its not dangerous to do so.

just2n 14y ago

Ahh. This brings back my memories of my teen years of reverse engineering. I enjoyed it so much I almost decided to go into malware analysis. Breaking crackmes, reversemes, spending hours writing code in C and dissecting what compilers came up with at all levels of optimization. Finding packers/protectors and figuring out how to remove them by hand and then building an olly script that would do it automatically. Cracking all the software you own (legally) just because. Back when CD cracks were still needed, I actually made my own, and it felt great. I did all of my hacking on a Windows machine but now I use OSX almost exclusively. Does anyone know of roughly equivalent tools in this world? Maybe I'll take up the hobby again.

zyb09 14y ago
Check out IDA Pro, I think it's the go to tool for reverse engineering on all platforms now. Haven't been looking into it for a while though.
- adr_ 14y ago
  For a mere US$1129...
  - Auguste 14y ago
    Given the nature of the hobby, I get the feeling that few people have paid for it. That said, the older IDA Pro 5.0 has been released as freeware: https://www.hex-rays.com/products/ida/support/download_freeware.shtml https://www.hex-rays.com/products/ida/support/download_freew...
  - zorlem 14y ago
    Given the maturity of the tool, the breadth of functionality, plugins, scriptability, etc. these are petty money for what IDA Pro has to offer to a professional that has to do Reverse Engineering for a living. I do agree that for a tool used for a hobby it is expensive, but for hobbyists there are other, simpler tools that could be used.
    - 14y ago

jasim 14y ago

As a kid fumbling around proprietary Windows binaries, I felt liberated by the ideas of Fravia and +ORC. They taught me that I deserve to know what goes on underneath the software I use. Softice, IDA and w32dasm were the tools of the trade. But most of it were limited to finding where the MessageBox with the trial message pops up and reversing the conditional jump just before it. Here is a small tutorial teaching how to reverse and remove the trial limitation of an ancient version of UltraEdit : http://71.6.196.237/fravia/uedilas.htm http://71.6.196.237/fravia/uedilas.htm But after switching to a fully opensource stack, reverse engineering lost its charm. Understanding how things work is taken for granted and I can't imagine going back to an opaque proprietary environment. Fravia passed away on 2009; but his archives are preserved here: http://71.6.196.237/fravia/index.htm http://71.6.196.237/fravia/index.htm

duiker101 14y ago
may I ask what is your fully opensource stack?
- adr_ 14y ago
  This is a bad answer, but when I'm on Linux, I use objdump and gdb for most of my reversing. They don't really compare to IDA, though. xxd is fine for hex editing, especially in the context of simple conditional jump changing, although there are much better open source hex editors.
zorlem 14y ago
What you link to is Fravia+ previous project, more focused on software reverse engineering - http://www.woodmann.com/fravia/ http://www.woodmann.com/fravia/. Fravia+'s last project - "Web Searchlores" was/is more aimed towards general reverse engineering and information searching. The site contains a huge collection of information, which curiously, although not updated for so many years, is still relevant today.pparently searchlores.org and fravia.com have expired and are "parked" by sombody. But looks like http://search.lores.eu/ http://search.lores.eu/ is the only remaining official mirror that remains from What you say about the F/OSS certainly rings true, but at least for me, software reverse engineering has always been more as a training ground for reversing in general than to cracking software copy protections. +greythorne has stopped updating his pages and +HCU's Linux infor, but mammon_ is pretty active, and even moved to Github: http://mammon.github.io/ http://mammon.github.io/ . Definitely worth checking out for more information about Software RE under GNU/Linux. Nowadays there are a lot of opaque software in widespread use, so the main focus has shifted towards web platforms, where reversing is still applicable. edit: style

grn 14y ago

You can also have some fun by doing crackmes at http://www.crackmes.de http://www.crackmes.de. Many crackmes require considerable technical and analytical skills. They also enable you to learn the underlying platform better.

mdaniel 14y ago

For all the comments about crackmes and patching around messageboxes, I would like to mention that reverse engineering is arguably more valuable for its ability to surface file format information and/or protocol specifics. In several countries, this is one of the expressly granted rights with respect to reverse engineering since it promotes interoperability and (more often than not) allows one to use a file format (or network service) long after the original software has expired [in the mortality sense]. I also highly recommend checking out the new http://reverseengineering.stackexchange.com/ http://reverseengineering.stackexchange.com/ since it is currently in its beta period and needs all the content it can get.