Getting Started for Reverse Engineering 100
Introduction to Reverse Engineering
Introduction
Reverse Engineering is an art of taking apart an engineered system be it a software program, hardware, or any engineered artifact to deconstruct and understand its internal structure, function, design and all bits of it to gain knowledge about its internal working and how the system works.
In Software regime fundamentally Reverse Engineering is an attempt to understand an existing system to gain it design and implementation details, analyzing the behavior of the program and putting this knowledge to work for original purpose. It involves reconstructing the knowledge gained in the process and designing the blueprint of the systems working.
Why Reverse Engineering?
Code Documentation
For software programs which don't have a documentation and the original source is lost or unavailable, typically for older backbone programs it becomes critical to understand the details of the program and to document it for future use.
Security Vulnerabilities and Patching
This is one of the top reasons, discovering Vulnerabilities and flaws in the software, the vulnerabilities discovered through this is often of high value and are usually of type mismanagement of various memory regions. Ever thought about patching a software program to maybe bypass a key-check or to hack a game or perhaps an urgent need to fix the critical vulnerability in the software, patching is the method in which the require part of the code is patched in the binary to attain a specific goal as mentioned above. Reverse Engineering is a fundamental skill one must know how the program works before they can find flaws and patch it.
Malware Analysis
To tear down the malware and know its internal working and methodology to better protect the infrastructure from such malware, it also helps understand different methods the attacker used to bypass the security system installed and improve their system, getting to know how a malware works is like reading the attackers genius mindset used to craft this malware.
National Security and Government
For purpose of defending and attacking in Cyber Warfare government use Reverse Engineering to find critical flaws in major system software and exploit them for there own benefit, RE is the most critical skill in order to gain hands on any such development.
Curiosity
One might be curious in understanding how the computer works, how a particular program works and get their hands dirt with a skill which is honorable.
Reversing Approaches and Tools
So once a goal and focus is set, one must wonder how do we get started with it, what do we need, is there a definitive steps which can lead to a solution, there must be some tool to do it?
The process completely depends on what you are trying to attain but there are some fundamental knowledge and tools for it.
System Level Reversing
A program fundamentally runs in an operating system, different tools can be leveraged to gain the information on the program, inspecting the programs flow, tracking input and output, various function working.
Code Level Reversing
This is the lowest purest form in which a program binary file is analyzed to get design and implementation details, the analysis is done with a help of a low level language and various tools are used to understand the working, this requires extensive knowledge of low level stuff such as assemblers, compilers, loader and linker, etc.
Static Analysis
This approach requires analyzing a program binary in a rest state when the binary is not executing. This requires converting analyzing the binary which is one’s and zeroes in more readable format such as assembly or pseudo-code, disassembler and decompilers can be used to do the same, it involves inspecting the programs code section and data section for implementation details and understanding data structure and building up control flow graph from it and getting in depth analysis of the inner working without actually executing the program.
Get Anoni’s stories in your inbox
Join Medium for free to get updates from this writer.
This is limited analysis one cannot actually see the data which is being passed on and any runtime packed code inside the binary, programs which encrypt or compress themselves can only unpack code when ran.
Dynamic Analysis
Instead of converting program binary to readable format it also involves executing the program live in the system and with the help of debugger trace the program see the data being passed onto the function, trace the execution of the program, see how the input data affects the flow of the program, etc.
Disassembler
Disassembler is one of the most important tool, it decodes the binary stream of instruction into machine instruction, when the program runs essentially this instruction is what the CPU executes but disassembler instead of executing it decodes and presents it in text.
Decompiler
A decompiler takes this step one level high it directly decodes the binary into a high level language a pseudo-code which is typically C language. This makes the code more readable and understandable, the decompiler cannot accurately produce the source code because the compilation process removes some information.
Debugger
Debuggers are design to help find a bug in the program, they can also be used as a tool for reversing, debuggers disassemble the running code and provide stepful execution of program and the CPU state such as registers, current stack frame, memory region is available. The ability of debugger to step into a function , set up a breakpoints at particular function or code help to trace out the execution and data flow and thus a good debugger becomes necessary in reversing.
