6 ms·

Reverse Engineering for Beginners

229 points by X4 12y ago

anonu 12y ago
It looks like a good resource from a very quick skim of the document. It is a shame, however, that the English may not be too polished.
- ivanca 12y ago
  You can always make a pull request.
  - voltagex_ 12y ago
    Apart from working out which .tex file corresponds to which piece of text, the files are tricky to read because they contain both english and russian strings delimited by some kind of macro. Any hints on editing this?
    - dennis714 12y ago
      Well, it's possible to grep these files :) See also: https://github.com/dennis714/RE-for-beginners/blob/master/CONTRIBUTING https://github.com/dennis714/RE-for-beginners/blob/master/CO...
erikb 12y ago
Why do you write a 600 page book and offer it for free?
- lipanski 12y ago
  http://blog.yurichev.com/node/80 http://blog.yurichev.com/node/80 I think it's a work in progress.
- deleted 12y ago
  [deleted]
- SoftwareMaven 12y ago
  Why do you write [an entire kernel, an operating system, an RDBMS, a web application framework, ...] and offer it for free? Sometimes, the journey of creation and the sharing are more important than any remuneration you might otherwise get.
  - zxexz 12y ago
    I hope he publishes a print version of the finished book, like Miran Lipovača did with Learn You a Haskell for Great Good! If someone releases a free book that has immense value to me, I'm more than willing to support them by buying a wonderful print version. There's something wonderful about having the ergonomics of a print book, combined with the ability to copy and paste and follow links from a PDF...
    - dennis714 12y ago
      Yes, I'll signup with service like lulu.com in future, for those who want hardback, when I'll feel I finish the thing, maybe 1-2 years later.
- analog31 12y ago
  Well, I've got nothing close to a 600 page book, but I offer a number of smaller documents at the website for my side business, plus some software and other design tools. If I have any ulterior motive, it's that those materials give me some technical credibility and maybe generate a bit of goodwill. Has it helped? Over the years, it's gotten me a little bit of "buzz" on web forums, and has attracted a couple of people who wanted me to do custom work for them. Also, in a manner akin to OSS, a couple people have been kind enough to report mistakes in my documents.
turnersr 12y ago
If you find binary reverse engineering fascinating and want to go deeper into the formal aspects checkout http://www.reddit.com/r/ReverseEngineering/comments/smf4u/reverser_wanting_to_develop_mathematically/ http://www.reddit.com/r/ReverseEngineering/comments/smf4u/re... and https://github.com/turnersr/turnersr.github.io/blob/master/technology_review/Technology_Survey.md https://github.com/turnersr/turnersr.github.io/blob/master/t... .
- wslh 12y ago
  This is a really great list but it missed hooking libraries/tools. A good thread about alternatives is also on the reverse engineering subreddit: http://www.reddit.com/r/programming/comments/22crn0/gpl_alternative_library_to_microsoft_detours_for/ http://www.reddit.com/r/programming/comments/22crn0/gpl_alte... Disclaimer: my company does one of the tools being discussed.
doctorpangloss 12y ago
This is an amazingly in-depth and up-to-date walkthrough. Way better than CS61. But... > "for Beginners" > links to GitHub repo full of .tex files O:
- cdash 12y ago
  Well, the readme links to a PDF.
  - X4 12y ago
    I thought linking to the source rather than to just the pdf would be more useful for you, as a) some might like to actually contribute and b) many would like to know what else the author made and lastly c) a minority of people isn't allowed to open pdf's from the internet, so they could build it locally (or just starr on github).
- johnlbevan2 12y ago
  Agreed. For anyone wanting to know what these files are, they're LaTeX; text files mixed with meta information. Detailed explanation of LaTeX: http://latex-project.org/intro.html http://latex-project.org/intro.html Software to work with LaTeX: http://latex-project.org/ftp.html http://latex-project.org/ftp.html
- peterwwillis 12y ago
  @johnlbevan2, you seem to be hellbanned.
awda 12y ago
Also useful for RE beginners: https://microcorruption.com/ https://microcorruption.com/
NhanH 12y ago
If I'm interested in reverse engineering, but at a higher abstraction than this book - let's say there is a game client communicating with server and I want to understand what the format of the packet is (ie. application level rather than all the way down) - does the question make any sense? And where could I find material for it?
- X4 12y ago
  Wireshark, Deep Packet Inspection and similar might be terms you can look after to find out more. RFCs are what you need to understand the protocols (if they are public standards)
- adestefan 12y ago
  A lot of paper and a lot of colored pencils. Start printing out network dumps of various game states and tracing out the fields in the packets.
voltagex_ 12y ago
For anyone reading this at the time of this post, GitHub is down.
kevinchen 12y ago
Ouch, bad time for GitHub to go down. Here is Google's cache: http://cl.ly/2i150V3c450i http://cl.ly/2i150V3c450i
- dennis714 12y ago
  Here is also links to PDF files: http://yurichev.com/RE-book.html http://yurichev.com/RE-book.html
kriro 12y ago
I always enjoyed this page (pretty old and more of a hackme featuring reverse engineering stuff): http://3564020356.org/ http://3564020356.org/ The hash maze is pretty interesting.
- thibauts 12y ago
  Good old times :)

229 points by X4 12y ago

anonu 12y ago

It looks like a good resource from a very quick skim of the document. It is a shame, however, that the English may not be too polished.

ivanca 12y ago
You can always make a pull request.
- voltagex_ 12y ago
  Apart from working out which .tex file corresponds to which piece of text, the files are tricky to read because they contain both english and russian strings delimited by some kind of macro. Any hints on editing this?
  - dennis714 12y ago
    Well, it's possible to grep these files :) See also: https://github.com/dennis714/RE-for-beginners/blob/master/CONTRIBUTING https://github.com/dennis714/RE-for-beginners/blob/master/CO...

erikb 12y ago

Why do you write a 600 page book and offer it for free?

lipanski 12y ago
http://blog.yurichev.com/node/80 http://blog.yurichev.com/node/80 I think it's a work in progress.
deleted 12y ago
[deleted]
SoftwareMaven 12y ago
Why do you write [an entire kernel, an operating system, an RDBMS, a web application framework, ...] and offer it for free? Sometimes, the journey of creation and the sharing are more important than any remuneration you might otherwise get.
- zxexz 12y ago
  I hope he publishes a print version of the finished book, like Miran Lipovača did with Learn You a Haskell for Great Good! If someone releases a free book that has immense value to me, I'm more than willing to support them by buying a wonderful print version. There's something wonderful about having the ergonomics of a print book, combined with the ability to copy and paste and follow links from a PDF...
  - dennis714 12y ago
    Yes, I'll signup with service like lulu.com in future, for those who want hardback, when I'll feel I finish the thing, maybe 1-2 years later.
analog31 12y ago
Well, I've got nothing close to a 600 page book, but I offer a number of smaller documents at the website for my side business, plus some software and other design tools. If I have any ulterior motive, it's that those materials give me some technical credibility and maybe generate a bit of goodwill. Has it helped? Over the years, it's gotten me a little bit of "buzz" on web forums, and has attracted a couple of people who wanted me to do custom work for them. Also, in a manner akin to OSS, a couple people have been kind enough to report mistakes in my documents.

turnersr 12y ago

If you find binary reverse engineering fascinating and want to go deeper into the formal aspects checkout http://www.reddit.com/r/ReverseEngineering/comments/smf4u/reverser_wanting_to_develop_mathematically/ http://www.reddit.com/r/ReverseEngineering/comments/smf4u/re... and https://github.com/turnersr/turnersr.github.io/blob/master/technology_review/Technology_Survey.md https://github.com/turnersr/turnersr.github.io/blob/master/t... .

wslh 12y ago
This is a really great list but it missed hooking libraries/tools. A good thread about alternatives is also on the reverse engineering subreddit: http://www.reddit.com/r/programming/comments/22crn0/gpl_alternative_library_to_microsoft_detours_for/ http://www.reddit.com/r/programming/comments/22crn0/gpl_alte... Disclaimer: my company does one of the tools being discussed.

doctorpangloss 12y ago

This is an amazingly in-depth and up-to-date walkthrough. Way better than CS61. But... > "for Beginners" > links to GitHub repo full of .tex files O:

cdash 12y ago
Well, the readme links to a PDF.
- X4 12y ago
  I thought linking to the source rather than to just the pdf would be more useful for you, as a) some might like to actually contribute and b) many would like to know what else the author made and lastly c) a minority of people isn't allowed to open pdf's from the internet, so they could build it locally (or just starr on github).
johnlbevan2 12y ago
Agreed. For anyone wanting to know what these files are, they're LaTeX; text files mixed with meta information. Detailed explanation of LaTeX: http://latex-project.org/intro.html http://latex-project.org/intro.html Software to work with LaTeX: http://latex-project.org/ftp.html http://latex-project.org/ftp.html
peterwwillis 12y ago
@johnlbevan2, you seem to be hellbanned.

awda 12y ago

Also useful for RE beginners: https://microcorruption.com/ https://microcorruption.com/

NhanH 12y ago

If I'm interested in reverse engineering, but at a higher abstraction than this book - let's say there is a game client communicating with server and I want to understand what the format of the packet is (ie. application level rather than all the way down) - does the question make any sense? And where could I find material for it?

X4 12y ago
Wireshark, Deep Packet Inspection and similar might be terms you can look after to find out more. RFCs are what you need to understand the protocols (if they are public standards)
adestefan 12y ago
A lot of paper and a lot of colored pencils. Start printing out network dumps of various game states and tracing out the fields in the packets.

voltagex_ 12y ago

For anyone reading this at the time of this post, GitHub is down.

kevinchen 12y ago

Ouch, bad time for GitHub to go down. Here is Google's cache: http://cl.ly/2i150V3c450i http://cl.ly/2i150V3c450i

dennis714 12y ago
Here is also links to PDF files: http://yurichev.com/RE-book.html http://yurichev.com/RE-book.html

kriro 12y ago

I always enjoyed this page (pretty old and more of a hackme featuring reverse engineering stuff): http://3564020356.org/ http://3564020356.org/ The hash maze is pretty interesting.

thibauts 12y ago
Good old times :)