3 ms·

Ahh. This brings back my memories of my teen years of reverse engineering. I enjoyed it so much I almost decided to go into malware analysis. Breaking crackmes,

by just2n 14y ago

Ahh. This brings back my memories of my teen years of reverse engineering. I enjoyed it so much I almost decided to go into malware analysis. Breaking crackmes, reversemes, spending hours writing code in C and dissecting what compilers came up with at all levels of optimization. Finding packers/protectors and figuring out how to remove them by hand and then building an olly script that would do it automatically. Cracking all the software you own (legally) just because. Back when CD cracks were still needed, I actually made my own, and it felt great. I did all of my hacking on a Windows machine but now I use OSX almost exclusively. Does anyone know of roughly equivalent tools in this world? Maybe I'll take up the hobby again.

zyb09 14y ago
Check out IDA Pro, I think it's the go to tool for reverse engineering on all platforms now. Haven't been looking into it for a while though.
- adr_ 14y ago
  For a mere US$1129...
  - Auguste 14y ago
    Given the nature of the hobby, I get the feeling that few people have paid for it. That said, the older IDA Pro 5.0 has been released as freeware: https://www.hex-rays.com/products/ida/support/download_freeware.shtml https://www.hex-rays.com/products/ida/support/download_freew...
  - zorlem 14y ago
    Given the maturity of the tool, the breadth of functionality, plugins, scriptability, etc. these are petty money for what IDA Pro has to offer to a professional that has to do Reverse Engineering for a living. I do agree that for a tool used for a hobby it is expensive, but for hobbyists there are other, simpler tools that could be used.
    - adr_ 14y ago
      Absolutely agreed, I just thought it was a bit of an expensive suggestion for someone thinking about getting back into the hobby.
  - michael_miller 14y ago
    If price is an issue, consider the freeware version: [1]. It disallows commercial use, and lacks recent features, but it should be great for a hobbyist. If you need more than this feature set, $1199 is a bargain for what you get with IDA Pro, as others have mentioned. [1] https://www.hex-rays.com/products/ida/support/download_freeware.shtml https://www.hex-rays.com/products/ida/support/download_freew...
    - emillon 14y ago
      It is also windows only.
adamnemecek 14y ago
Hopper is decent and has been getting better http://www.hopperapp.com http://www.hopperapp.com. It's not IDA (yet), but it's decent.
j4_james 14y ago
Like a lot of people here, this brings back fond memories. For me, the first real experience of disassembling was with DOS games, when you would use a TSR (terminate and stay resident) debugger to hook into a running executable and try and figure out what it was doing. I think at the time I was mostly interested in hacking infinite lives - I was a lousy gamer. I remember one of the tricks used by apps was to encrypt the code in some way, and rely on the DOS single-step interrupt to execute the decryption process as the code was run, one instruction at a time. The idea was to prevent static disassembly with the encryption while also discouraging run-time analysis (since a debugger would usually overwrite the single-step interrupt that fired off the decrypter). I actually ended up writing my own TSR debugger that could step through such code by chaining the interrupts. It could also detect many of the self extracting compression formats and jump past the decompression stage on startup so you didn't spend the first 10 minutes trying to step through decompression code. I was quite proud of that app. Then in the late 90s I moved on to Windows disassembly, when I became somewhat obsessed with uncovering the undocumented APIs in Windows 95. I even had a Geocities website where I used to publish some of my findings. The site is obviously gone now, but it's still mirrored in a few places. In case anyone is interested, there's a mirror here: http://koti.mbnet.fi/vaultec/files/miscellaneous/undocw95/ http://koti.mbnet.fi/vaultec/files/miscellaneous/undocw95/
integricho 14y ago
I found this alternative interesting: http://www.radare.org/y/ http://www.radare.org/y/? although not nearly as powerful as IDA, it's open source nature makes it perfect..

by just2n 14y ago

zyb09 14y ago

Check out IDA Pro, I think it's the go to tool for reverse engineering on all platforms now. Haven't been looking into it for a while though.

adr_ 14y ago
For a mere US$1129...
- Auguste 14y ago
  Given the nature of the hobby, I get the feeling that few people have paid for it. That said, the older IDA Pro 5.0 has been released as freeware: https://www.hex-rays.com/products/ida/support/download_freeware.shtml https://www.hex-rays.com/products/ida/support/download_freew...
- zorlem 14y ago
  Given the maturity of the tool, the breadth of functionality, plugins, scriptability, etc. these are petty money for what IDA Pro has to offer to a professional that has to do Reverse Engineering for a living. I do agree that for a tool used for a hobby it is expensive, but for hobbyists there are other, simpler tools that could be used.
  - adr_ 14y ago
    Absolutely agreed, I just thought it was a bit of an expensive suggestion for someone thinking about getting back into the hobby.
- michael_miller 14y ago
  If price is an issue, consider the freeware version: [1]. It disallows commercial use, and lacks recent features, but it should be great for a hobbyist. If you need more than this feature set, $1199 is a bargain for what you get with IDA Pro, as others have mentioned. [1] https://www.hex-rays.com/products/ida/support/download_freeware.shtml https://www.hex-rays.com/products/ida/support/download_freew...
  - emillon 14y ago
    It is also windows only.

adamnemecek 14y ago

Hopper is decent and has been getting better http://www.hopperapp.com http://www.hopperapp.com. It's not IDA (yet), but it's decent.

j4_james 14y ago

Like a lot of people here, this brings back fond memories. For me, the first real experience of disassembling was with DOS games, when you would use a TSR (terminate and stay resident) debugger to hook into a running executable and try and figure out what it was doing. I think at the time I was mostly interested in hacking infinite lives - I was a lousy gamer. I remember one of the tricks used by apps was to encrypt the code in some way, and rely on the DOS single-step interrupt to execute the decryption process as the code was run, one instruction at a time. The idea was to prevent static disassembly with the encryption while also discouraging run-time analysis (since a debugger would usually overwrite the single-step interrupt that fired off the decrypter). I actually ended up writing my own TSR debugger that could step through such code by chaining the interrupts. It could also detect many of the self extracting compression formats and jump past the decompression stage on startup so you didn't spend the first 10 minutes trying to step through decompression code. I was quite proud of that app. Then in the late 90s I moved on to Windows disassembly, when I became somewhat obsessed with uncovering the undocumented APIs in Windows 95. I even had a Geocities website where I used to publish some of my findings. The site is obviously gone now, but it's still mirrored in a few places. In case anyone is interested, there's a mirror here: http://koti.mbnet.fi/vaultec/files/miscellaneous/undocw95/ http://koti.mbnet.fi/vaultec/files/miscellaneous/undocw95/

integricho 14y ago

I found this alternative interesting: http://www.radare.org/y/ http://www.radare.org/y/? although not nearly as powerful as IDA, it's open source nature makes it perfect..