EvilZone

Hacking and Security => Reverse Engineering => : xLuckySzx September 06, 2015, 09:43:09 PM

: [?-HELP] Reverse enginering
: xLuckySzx September 06, 2015, 09:43:09 PM

I started studying reverse engineering a few days ago, I already know a bit of c#, c++ and the bases of other less known languages.
The problem is that I don't know where I should start...
I have read a few guides about reverse engineering, but I think I should study assembly before starting Reverse engineering. :-[

I hope
 you can help me!

: Re: [?-HELP] Reverse enginering
: white-knight September 06, 2015, 11:34:07 PM

https://www.youtube.com/results?search_query=reverse+engineering+tutorial


Google  reverse engineering for beginners.    Go Go gadget GOOOOOOOGGGGLLLLEEEEE 

: Re: [?-HELP] Reverse enginering
: xLuckySzx September 07, 2015, 12:03:15 AM

I meant: Do I need any particular knowledge before starting studying Reverse engineering?

: Re: [?-HELP] Reverse enginering
: chris September 07, 2015, 12:04:04 AM

: white-knight  September 06, 2015, 11:34:07 PM

https://www.youtube.com/results?search_query=reverse+engineering+tutorial (https://www.youtube.com/results?search_query=reverse+engineering+tutorial)


Google  reverse engineering for beginners.    Go Go gadget GOOOOOOOGGGGLLLLEEEEE

LMFAO!


+1

: Re: [?-HELP] Reverse enginering
: white-knight September 07, 2015, 12:15:50 AM

: xLuckySzx  September 07, 2015, 12:03:15 AM

I meant: Do I need any particular knowledge before starting studying Reverse engineering?

I have only tinkered with it a small bit. If you know assembly it might help. 


You can do some crackme challenges also to learn .


Also here is some free videos to learn also with challenges
http://www.top-hat-sec.com/r4v3ns-blog/top-hat-sec-reversing-mini-series (http://www.top-hat-sec.com/r4v3ns-blog/top-hat-sec-reversing-mini-series)

: Re: [?-HELP] Reverse enginering
: xLuckySzx September 07, 2015, 12:17:21 AM

Thank you

: Re: [?-HELP] Reverse enginering
: Deque September 07, 2015, 08:06:52 AM

: xLuckySzx  September 06, 2015, 09:43:09 PM

I started studying reverse engineering a few days ago, I already know a bit of c#, c++ and the bases of other less known languages.
The problem is that I don't know where I should start...
I have read a few guides about reverse engineering, but I think I should study assembly before starting Reverse engineering. :-[

I hope
 you can help me!

If you want to RE native binaries, yes, learn assembly before you start.

: Re: [?-HELP] Reverse enginering
: hcac September 07, 2015, 09:09:53 AM

xLuckySzx, there is basic and advanced in re. In basic analysis you don't need any assembly for either static or dynamic (run time) analysis on malware/executable. However for "Advanced static analysis" you need to be able to read assembly.
By the way I liked the book Practical Malware Analysis, I think it's good to first learn some basic analysis and then going through assembly.
Wish you do well in re <3

: Re: [?-HELP] Reverse enginering
: xLuckySzx September 07, 2015, 10:22:45 AM

I wanna extract algorithms for key generation from known programs, so I think I should learn assembly before, am I right? Anyways thank you for the replies.


EDIT: Now I am trying to crack LaFarge #2 crackme, but it seems still too early...
Has anyone got a good Assembly and RE guide? At the moment I can't find anything good... I have already finished the ones that white-knight suggested me, but I think they were too easy even though they were really well explained.

[Sorry for any grammar error but I am not english]

: Re: [?-HELP] Reverse enginering
: hcac September 08, 2015, 08:15:45 AM

Did you try any books? take a look at the ez book index (https://evilzone.org/wiki/index.php/The_big_ebook_index), you'll probably find helpful books.
And one more thing, you can't find anything good? If you want to start with asm just go through a book! There are lots of them.
For assembly, myself, I liked the book "Programming Ground up" which teaches assembly att syntax. (I'm not sure about the full name of the book) It was good for starting and I didn't feel  tired while reading it (it wasn't hard).

: Re: [?-HELP] Reverse enginering
: xLuckySzx September 08, 2015, 12:16:11 PM

Thank you again, I'll look for this book.
 I have tried to study Assembly with an application on my phone, but it was too complicated...
Is this the guide you meant? http://download-mirror.savannah.gnu.org/releases/pgubook/ProgrammingGroundUp-1-0-booksize.pdf

: Re: [?-HELP] Reverse enginering
: hcac September 08, 2015, 01:18:18 PM

Yup, that's the one. That shouldn't look very complicated.
However learning assembly needs some patience. The complicated thing I think is the "Low level programming" and the language its self is simple (means don't give up in the begining).

: Re: [?-HELP] Reverse enginering
: xLuckySzx September 08, 2015, 02:01:54 PM

ok ^^ Now I start reading

: Re: [?-HELP] Reverse enginering
: Deque September 08, 2015, 09:27:24 PM

: xLuckySzx  September 07, 2015, 10:22:45 AM

I wanna extract algorithms for key generation from known programs, so I think I should learn assembly before, am I right? Anyways thank you for the replies.


EDIT: Now I am trying to crack LaFarge #2 crackme, but it seems still too early...
Has anyone got a good Assembly and RE guide? At the moment I can't find anything good... I have already finished the ones that white-knight suggested me, but I think they were too easy even though they were really well explained.

[Sorry for any grammar error but I am not english]

Lena's Tutorials are by far the best: https://tuts4you.com/download.php?list.17
(Site is down atm, I hope this changes soon).
LegendofRandom's tutorials were great too, but his site has been down for weeks. I don't think this will change. I believe tuts4you had his tutorials as download as well.

Try to get hands on this book:

(https://dynamic.indigoimages.ca/books/1118787315.jpg?altimages=true&width=310&quality=85&maxheight=310&lang=en&z=100026988bc481945514ceb6a3e444d8a28be436d6c49-7)

: Re: [?-HELP] Reverse enginering
: xLuckySzx September 08, 2015, 09:32:03 PM

I will also try these ones

: Re: [?-HELP] Reverse enginering
: 0E 800 September 09, 2015, 12:23:56 AM

: Deque  September 08, 2015, 09:27:24 PM

Try to get hands on this book:

(https://dynamic.indigoimages.ca/books/1118787315.jpg?altimages=true&width=310&quality=85&maxheight=310&lang=en&z=100026988bc481945514ceb6a3e444d8a28be436d6c49-7)

Here:
https://evilzone.org/ebooks/practical-reverse-engineering/msg78110/#msg78110

Here is a torrent link for a bundle of RE books:
https://kat.cr/reverse-engineering-ebook-pack-t8894299.html

- Art of Assembly Language, The - Hyde, Randall - Assembly Language Step-by-Step_ Programming with Linux - Duntemann, Jeff - Bug Hunter's Diary, A - Tobias Klein - Gray Hat Python_ Python Programming for Hackers and Reverse Engineers - Seitz, Justin - Guide to Kernel Exploitation_ Attacking the Core, A - Perla, Enrico & Oldani, Massimiliano - Hacking_ The Art of Exploitation_ The Art of Exploitation - Erickson, Jon - IDA Pro Book_ The Unofficial Guide to the World's Most Popular Disassembler, The - Eagle, Chris - Linux Malware Incident Response_ A Practitioner's Guide ile Data - Cameron Malin & Eoghan Casey & James Aquilina - Malware Forensics Field Guide for Windows Syst Field Guides - Casey, Eoghan;Malin, Cameron H - Practical Malware Analysis_ The Hands-On Guide to Dissecting Malicious Software - Sikorski, Michael & Honig, Andrew - Practical Reverse Engineering_ x86, x64, ARM, Windows Kernel, Rev Obfuscation - Dang, Bruce & Gazet, Alexandre & Bachaalany, Elias - Reversing_ Secrets of Reverse Engineering - Eilam, Eldad

: Re: [?-HELP] Reverse enginering
: matt_9908 September 09, 2015, 01:30:41 AM

: Deque  September 08, 2015, 09:27:24 PM

LegendofRandom's tutorials were great too, but his site has been down for weeks. I don't think this will change.

I have downloaded his tutorials a few moths ago. You can get them in the attachment.

: Re: [?-HELP] Reverse enginering
: xLuckySzx September 09, 2015, 01:54:16 AM

Thank you again for being really friendly and helpful. I think now I have enough books to study, I will read as much as possible.

: Re: [?-HELP] Reverse enginering
: Deque September 09, 2015, 07:27:33 AM

: xLuckySzx  September 09, 2015, 01:54:16 AM

Thank you again for being really friendly and helpful. I think now I have enough books to study, I will read as much as possible.

You will have most success in learning RE if you concentrate on a few sources only and exercise a lot.
Lena's (or Random's) tutorials are great, if you actually do yourself what they teach you and not just consume.
They are enough fooder for a few months (at least weeks, if you have lots of time) of learning.

: Re: [?-HELP] Reverse enginering
: gray September 09, 2015, 06:48:58 PM

Lena's tutorials are awesome, that's what I'm going through at the moment and I can say I've learned a ton. They are a great example of what you can learn by doing instead of reading ( not that reading is bad, but in my case, I've had best results with practical learning).

You can find Random's tutorials along with other guides and tutorials here: http://octopuslabs.io/legend/blog/sample-page.html

Tiga's video tutorials on Ida is also a good series: http://www.woodmann.com/TiGa/idaseries.html

: Re: [?-HELP] Reverse enginering
: xLuckySzx September 09, 2015, 07:56:34 PM

I have a little problem with the first ReverseMe, When I start it in OllyDbg it says: Cannot find the entry point SendDlgitemMessageW the procedure in the dynamic link library C : \ Windows \ System32 \ ole32.dll

: Re: [?-HELP] Reverse enginering
: gray September 09, 2015, 08:35:49 PM

I didn't run into your problem, but I recommend you use Win XP for these tutorials, I started on Win 7 but then switched to XP when some programs wouldn't work properly on 7. 

: Re: [?-HELP] Reverse enginering
: novaccainne October 06, 2015, 02:47:20 PM

Hi , I think there are a lot of good books are published on the internet but I think you should start it with Lena's reverse enginnering tutorial because it shows you the power of reverse enginnering and of course the basics of reverse engineering.  You can download it from tuts4u. It is a very good primer for everyone :)

A lot of good articles can be found on  infosec resources : http://resources.infosecinstitute.com/category/reverse-engineering-2/ .

Tuts4u is also a good site : https://tuts4you.com/download.php

RCE forum is also a good site : http://www.woodmann.com/forum/content.php

: Re: [?-HELP] Reverse enginering
: novaccainne October 06, 2015, 02:52:49 PM

: xLuckySzx  September 09, 2015, 07:56:34 PM

I have a little problem with the first ReverseMe, When I start it in OllyDbg it says: Cannot find the entry point SendDlgitemMessageW the procedure in the dynamic link library C : \ Windows \ System32 \ ole32.dll

You may got the above exception message because it might be there is no entry point of the SendDlgitemMessageW procedure. Did you check it ? Have you fully watched the video ? 

: Re: [?-HELP] Reverse enginering
: Trevor October 06, 2015, 05:06:32 PM

: xLuckySzx  September 09, 2015, 07:56:34 PM

I have a little problem with the first ReverseMe, When I start it in OllyDbg it says: Cannot find the entry point SendDlgitemMessageW the procedure in the dynamic link library C : \ Windows \ System32 \ ole32.dll

Ollydbg is correct. SendDlgItemMessageW  is in user32.dll and NOT IN ole32.dll.
Check in MSDN https://msdn.microsoft.com/en-us/library/windows/desktop/ms645515(v=vs.85).aspx (https://msdn.microsoft.com/en-us/library/windows/desktop/ms645515(v=vs.85).aspx)

The most probable reason for the error is you are using a newer version of Windows. My guess is Windows 10.

You need to use Windows XP 32bit. I would recommend using a VM if you are not already doing so.

: Re: [?-HELP] Reverse enginering
: parad0x October 06, 2015, 05:37:08 PM

: Trevor  October 06, 2015, 05:06:32 PM

You need to use Windows XP 32bit. I would recommend using a VM if you are not already doing so.

Use SP2 or SP3, not SP1

: Re: [?-HELP] Reverse enginering
: cupcake January 06, 2016, 01:44:46 AM

I recommend studying code patterns and what they are translated into assembly. Then you can try tackling some crackmes.

: Re: [?-HELP] Reverse enginering
: multi168 January 30, 2016, 04:18:58 AM

: cupcake  January 06, 2016, 01:44:46 AM

I recommend studying code patterns and what they are translated into assembly. Then you can try tackling some crackmes.

As a beginner you can also start a bit  more high-level with practicing reverse engineering. Decompiling a dotnet or java application for example.

For dotnet you can use ILSpy for example and decompile to C# and MSIL (MSIL is more or less the assembler code of a virtually emulated dotnet CPU). Studying the difference between code you wrote yourself, the reversed/decompiled C# version and the MSIL version can give you a good start in understanding code patterns and how they would look when you reverse engineer them in a low level language.