EvilZone

Twitter.

Obviously.. But the point of this topic was to get some feeds! Post in more details mate

I posted link about hacker mindest,not cracker mindest

Makes no sense.

Are you suggesting this topic is about a crackers mindset?

Yes, this is a how-to-start-hacking topic. Yet another one.. I hope this topic will guide new hackers out there in the right direction. Or the direction which I see as right anyway.

---

I have seen this board(Evilzone), and IRC- having a lot of people asking; Where to start? But there are few real good answers. There has been answers, but I can understand the issues surrounding answering, making none of the answers complete. And to be honest, there is no answer. Only guidence. Where to begin is not one fixed point. It will totally depend on what aspects of hacking you want to learn(first?). As well as your definitions of a hacker or and hacking.

Lets start off by getting some definitions straight. These are not facts, but rather how I like to see things. And how most other experienced hackers like myself views things. There are no right or wrong. But my understanding is that Evilzone got many of the same point of views as me, therefore I believe the coming definitions will fit smoothly for anyone browsing Evilzone and are willing to learn. If you disagree with my definitions you better have a good reason why. Or not. Who am I to judge.

---

<definitions>

A hacker is a knowledgeable person with a mindset fit to crack any challenge. He or she might even enjoy the challenge more than the end product. In general a hacker is creative, not destructive. But destruction will most likely happen at some point. A hacker will never let his challange go without a real fight. A hacker will act professional in all situations, speak properly and remain calm in any situation. And last but not least, a hacker has a lot of fun.

Hacking is in very broad words; Fixing, modifying or make something do something it was not designed to do. This is the stereotypical definition of hacking. Hacking is not limited to computer related stuff. This is an important note. However, the word hacking is today mostly used for the idea of computer-hacking.
Software exploitation is hacking because you are making the software do something it was not designed for.
Web-application exploitation is hacking because you are making the software run in a way the designer did not intend.
Reverse engineering is hacking because programs was not designed to be decompilable.
Social engineering is hacking because you are making people do something they would not have done without modification of the situation.
And so on.

</definitions>

---

Now we have laid down some ground rules for the coming words. Many of you probably already knew this. But this is a beginner topic. So we have to start with the basics.

Lets jump back to the question; Where to start?
Again, you have to pick a more narrow topic within the bounds of hacking. But then again, how can you do that when you do not know its aspects. I will try to list most of the aspects of hacking, but this is no way a complete list;



The stereotypical computer-hacker topics:

---

Software exploitation
- Exploiting user-input vulnerabilities like bufferoverflow to gain control over programs that was not intended to be controlled.
Will require a in-depth understanding of computer logics and programming. C/++, ASM, Perl or and Python are key languages that should be learned. In order to perform software exploitation you will need to know how to code vulnerable code, how to spot it and how to NOT code vulnerable code.
Can be used to hack almost any system, locally and remotely.

How to start:
- C# / VB
- Perl / Python
- C / C++
- Assembly
- Hacking theory ( Bufferoverflows )



Web-application exploitation
By far the most used method to get publicity now-days. Exploitation of server-side scripts and programs running web interfaces. Typical topics: Remote File Inclusion(RFI), Local File Inclusion(LFI), SQL injection, Cross Site Scripting(XSS) and Cross Site Request Forgery(CSRF). There will be other topics to, either mix-ups of the ones above, similar ones or completely different ones.
Must-know languages: PHP, HTML, Javascript, SQL and one of the following Perl, Python, C/++
You should also have good knowledge on TCP/IP stuff.

How to start:
- HTML
- Javascript
- PHP
- SQL (MySQL)
- Perl / Python
- C / C++
- Hacking Theory ( RFI, LFI, XSS, SQLi and SCRF )



Software modification
Changing software to do as you want it to. Typically called cracking, reversing or patching. This will allow you to remove or add things like license, mods, hacks to all sorts of applications.
To do this, you need an in-depth understanding of programming languages, compilers, linkers and IDE's. As well as understanding computer logic and machine code translated to Assembly. You will need to know how to work with a debugger and decompilers and disassemblers.
You probably need to know Assembly, C/++, Perl/Python and more wont hurt.

How to start:
- C# / VB
- Perl / Python
- C / C++
- Assembly
- Hacking theory ( Debugging, patching and mods )

---

Less computer related hacking:

---

Social Engineering
The ability to manipulate people into doing things they would not normally do in the given situation. Straight up tricking people.
To do this, you simply need to Practice. Don't force it, just act natural. Understand concepts of trust and so forth.
Many major hacks have been pulled off like this.

How to start:
- Chat around
- Chat some more
- Body language
- Facial expressions
- Trust concepts
- Psychology
- Start doing small scale engineerings
- Have fun

---

In addition, maybe except Social Engineering. In-depth computer logics, concepts and understanding are a must. But you don't really need to think about it that much, as you will gain that by learning to code, using your computer and so forth.

---

I will end this text here for the moment. This tutorial is not complete, maybe it will. Some time. There about a million more words that could be written. More to come later.

---

Notes:
- Hacker behavior
- Maturity
- Proper writing
- Coding is the key to all success
- How to start coding
- Coding project
- Make projects
- Make plans
- Write down ideas
- Follow your ideas
- Share your ideas
- Use Google
- Set goals
- Follow your goals
- Hacker mind set in every day life
- Good jobs
- Lots of money to be made
- Most importantly, have fun

I think everything is correct. Nice summary.That's it. You have an array of those sctructures at OptionalHeader->DataDirectory. It has 16 members, in order: export, import, resource, exception, security, basereloc, debug, copyright, globalptr, tls, load_config, bound_import, iat, delay_import, com_descriptor.
DataDirectory, being that structure you said, has Size (its size, obviously) and VirtualAddress, which is a RVA. If you want the real physical address of that section in the file, you have to do it like this:
Physical_Address = RVA - [Container section].VirtualAddress + [Container section].PointerToRawData
This RVA thing is a pain, when you are exploring a PE file in C you have to be always doing this conversion.

Yes, I am aware of the RVA issue. But I wrote a function for it that can convert any RVA to physical offset.

Also, I was thinking about writing some texts about PE as I am learning. Would you like to do it together?

I could possibly help out, double check facts and such. I am still reading up on OpCodes and how the CPU instructions are organized and a little bit of more PE structure.

if the instruction line are 2 - 14 long
then try
the total amount of bytes - (the number of bytes that are used for setting the length)
then divide by 2 / 14 and see which gives a good number
since the length of those instruction line are set to a certain number
then the length of the total amount of bytes should be in the range of the Multiplication table of that number
but you have to exclude the first bytes from the total amount since they set the whole length
at least this is what I think
I have no further knowledge of this stuff

If it only was that simple

Basically, there is no way knowing from reading it anywhere how long each instruction is. You have to judge it by the byte values.
First there is a instruction prefix that can be anything from 0 to 4 bytes(optional), this prefix modifies the function of the instruction, which is the coming 1 or 2 bytes(required). Then there is another 1 byte(optional) that does modification to the way the instruction work. Then another 1 byte that does more modification of the instruction(optional). Then there is something called displacement(optional) which I am not 100% what is, I am reading this right now. Then there is the last bytes which is immediate data, 1 to 4 bytes(optional)

In total there is 1 byte minimum and 16 bytes maximum for each instruction. More on this later.


I have been reading tons and tons of research the past days, learned a lot. I will maybe write a rather large guide/tutorial or whatever on PE/COFF, reading headers and starting reversing of PE's from bottom up and close up the two topics I have about this to now.

We could keep this thread alive with our research in this topic. It could be helpful to both us and the rest of people interested.

Sure, ill post up some info when I have done a bit more coding and things are starting to work

Okay so. I have managed to read in the IMAGE_DOS_HEADER structure, locate the PE header address, address of the IMAGE_NT_HEADERS structure. Read in the IMAGE_NT_HEADERS signature. Read the IMAGE_FILE_HEADER inside the IMAGE_NT_HEADERS structure. Read big parts of IMAGE_OPTIONAL_HEADER which is also a part of IMAGE_NT_HEADERS. However, the last bit in IMAGE_OPTIONAL_HEADER got me confused;

The DataDirectory structure inside IMAGE_OPTIONAL_HEADER, IMAGE_DATA_DIRECTORY. Its an array of the structure IMAGE_DATA_DIRECTORY, which is 2x 4 bytes(VirtualAddress and isize DWORD's). The array length is 16, so 16 * 8 bytes = 128 bytes. However, I don't understand where to read this/these structures.

The last DWORD successfully read in IMAGE_OPTIONAL_HEADER is NumberOfRvaAndSizes and right after that is the array of the structure IMAGE_DATA_DIRECTORY, DataDirectory[]. Now, where do you read those IMAGE_DATA_DIRECTORY[]'s? It dosen't fit right after the NumberOfRvaAndSizes.. Rather, it doesn't match up.



EDIT:

Okay, wait! I just read trough my old comments:
        // DWORD NumberOfRvaAndSizes                     // [b]The length of the DataDirectory array that follows[/b].                     // 4 bytes
        // IMAGE_DATA_DIRECTORY DataDirectory[]     // An array of IMAGE_DATA_DIRECTORY, lenght = 16                      // 8 bytes * 16

So, am I right if I am supposed to read the next 8 bytes * (NumberOfRvaAndSizes/8) into structures of IMAGE_DATA_DIRECTORY?