Reversing thread

ITT: anything reverse engineering related Here you can post your favorite tools, tricks, books, ctf problems, etc >r2 extensions https://r2wiki.readthedocs.io/en/latest/home/radare-plugins/ >Open sec http://opensecuritytraining.info/ReverseEngineeringMalware.html >Binary exploitation http://security.cs.rpi.edu/courses/binexp-spring2015/ >YT https://www.youtube.com/channel/UCVFXrUwuWxNlm6UNZtBLJ-A https://www.youtube.com/channel/UCLDnEn-TxejaDB8qm2AUhHQ https://www.youtube.com/channel/UC--DwaiMV-jtO-6EvmKOnqg https://www.youtube.com/user/virusbtn https://www.youtube.com/channel/UCNWVswPNgn5kutPNa5sprkg >Challenges https://malwr.com/ (currently down) https://challenges.re/ https://github.com/ctfs/ https://reverse.put.as/crackmes/ http://www.crackmes.de/ >HEX https://www.sweetscape.com/010editor/ https://mh-nexus.de/en/hxd/

>>ITT: anything reverse engineering related Everything may be. Depends what you RE.

Anyone have an experience with Ghidra?

>>12554 I've never done any reversing myself, but I quickly checked the source code for the words "telemetry" and "backdoor" and it seems to be clean - they can't officially just spy on people like that it seems. In my opinion it looks decent.

>>12555 Is that how you do it? They'd just outright call it telemetry? Lol if I was suspicious Id get it through a tor node and unplug the router while I used it. It's probably best to use it on a virtual machine anyway lest what you're dissecting take over.

>>12559 >Is that how you do it? They'd just outright call it telemetry? Yes? See Windows source code leaks. They literally named NSA's public key "_NSAKEY" and the most current XP leak has over 300 occurrences of the word "backdoor". https://en.wikipedia.org/wiki/NSAKEY I'm not saying this is an equivalent of doing a full audit, but I still think they can't just officially add telemetry and spyware to their software.

>>12554 r2ghidra is pretty cool https://github.com/radareorg/r2ghidra

Maybe this isn't related enough, but maybe people can share info about exploit discovery and exploitation.

>>12560 Jesus christ, they aren't even trying are they?

>>12554 It's great but there are many points to be made about how sucking your own dick is a better thing to do than installing Java (or writing scripts in Jython). :) But if you enjoy RE and can't afford IDA, or if you have no problem with Java, go for it. >>12559 >>12560 Rob Joyce acknowledged that: >There is no backdoor in Ghidra. >This is the last community you want to release something out to with a backdoor installed, to people who hunt for this stuff to tear apart. And to everyone who attempts to use r2 for any serious RE: if you can't get it to segfault at least 7 times a day, you're not working hard enough. Cutter is pretty cool and I like it but it's gonna take some time before it gets to a similar level of usability as IDA/Ghidra. Sadly, the latest version (1.12.0) freezes way too often on me. Though it does get bonus points for being much prettier than IDA and Ghidra.

>>12568 >>This is the last community you want to release something out to with a backdoor installed, to people who hunt for this stuff to tear apart. Have you guys thought of idea that ghidra itself could be vulnerable to some code it is trying disassemble? jeez

>>12577 But how is that related to telemetry/backdoors in Ghidra? Any disassembler can be vulnerable to the code it is trying to disassemble (take binutils for example). If vulnerability is what you mean then yes, dissecting malware in a sandbox is a safety precaution you should take. With that being said, Ghidra is very likely free of backdoors as we know them.

How to get into RE'ing hardware?

>>12562 have fun :) http://index-of.es/Exploit/

i started learning assembly to understand rev better but i saw that assembly is little bit different from what assembly we get during decompiling, why is that ?

>>12985 >assembly is little bit different from what assembly we get during decompiling What exactly do you mean? Do you mean how the assembly you write is different from the assembly you end up with when you disassemble, say, a C program? Well, this depends on the architecture. If you learn IA-32, i.e., 32bit x86 (which is what many people, including me, start with), and disassemble a 64bit binary, you will end up with different assembly because 64b and 32b x86 differ. If you learn a completely different architecture, e.g., ARM, and disassemble x86, you will of course get a completely different instruction set. Another problem is that there are basically two instruction sets: RISC (Reduced) and CISC (Complex). To explain it simply; in RISC a single instruction usually performs one operation while in CISC a single instruction can perform multiple operations. Since there are many things which can be done at once, CISC is usually much larger than RISC. And here's the catch -- x86 is CISC and it is known for being fuarrrking gigantic (https://en.wikipedia.org/wiki/X86_instruction_listings) because of its many extensions. If you disassemble optimized or obfuscated code (and that's what you usually do if you reverse malware or crack stuff), there's a very high chance you will stumble upon instructions which you've never seen before (can you tell be what vpcmpd does?). This post seems a little convoluted so here are the basics: >Different architectures exist >Some architectures have many extensions and are gigantic >x86 is one of them >Optimized code often uses uncommonly used, optimized instructions

>>12986 the last thing that you mentioned might be the case. Things that compiler does to optimize code is weird. I am aware about the architecture and other details you mentioned. i meant sometimes the pop operation is changed >add esp, 4 >mov ecx, [esp] which is just the extended from of push.

Any resource for android app reverse engineering? I'm bit lost.

>>14359 Where exactly are you lost? It is pretty easy with something like apktool alone (or, if you only want to reverse it just unzipping the apk) and then looking at the dex files. It is a lot more readable tham asm.

>>14359 In addition to what >>14366 said, I would recommend jadx for a decompiler. Also, reading through Android docs may be helpful.

Anyone here familiar with the hackthebox reversing challenges? I'm tackling Poly and managed to figure out the password and reversed every bit of code possibly touched at runtime with the unpatched binary but I'm completely stumped by the fuarrrking riddle. None of the values generated by the RNG seem to line up with how I'd expect the program to have to be modified and I've ran out of ideas. Can anyone give me a nudge? If you're not as far yet I'd be happy to provide nudges in the right direction as well.

>>14555 While I don't have an answer to your technical question I can tell you that I hate HTB for this reason and recommend AGAINST using it to everyone I know. With HTB you get someone's dumb-ass mind games, not necessarily a properly structured technical challenge.

>>14579 I was using HTB because it has a diverse set of challenges that change every once in a bit and serves as a decent way to track my progress, though I have to admit I only started with it less than a month ago, and I'm not very acquainted with the bigger cybersec-sphere. You're right with the mindgames, this one's driving me nuts and isn't a very realistic challenge. If HTB is this unfun, what would you recommend? I've only partially done microcorruption before and am mostly looking to expand my skillset in this field to maybe switch careers in the future.

>>12591 Bumping

>>12591 What about it do you want to RE? Your question is extremely vague. Dumping a microcontroller's firmware can be hard and/or require you to exploit the firmware, unless you have physical access to a chip it's stored on or the microcontroller's documented and its flash is unprotected. Once dumped it's just software RE with more datasheets. Figuring out the PCB layout means finding documentation on each of the components and figuring out how they connect, which can be a massive pain if it's a multilayer board or just huge. REing a single chip is fuarrrking expensive, as it requires a method known as "chip decapping", and even then you require good knowledge on how those things look internally. The easier method here is to blackbox it, by making a breakout board/testbench and poking it in different ways to see what it does. That said, you'll find that most components are off-the-shelf and have some form of datasheet or documentation. This all said, with some luck what you're REing is one of those modern soyakfty " embedded linux" systems and you can just access a serial shell over some pins, and dump/re the software.

lainchan CTF team when? >No IDA Pro in OP Also, add reversing.kr and REClass to OP. Anyone into reversing games and not babby hurr durr gib me flag sh1t?

Hi Lain, noob questions here I'm getting into reverse engineering for CTFs, so I need to know at least the basics of Assembler, mostly ARM and x86. So I want to first get a solid foundation of assembler programming. How to I best try written code? Are there good assembler interpreters out there for ARM and x86? I don't find the right things, but maybe I'm looking wrong. What would be a good way to write, test debug ARM and x86 assembler, when I'm on a standard linux distro on a x86 _64 processor?

>>15606 You can install a gcc arm cross compiler and then use qemu-arm to run the executable. But is probably easier to run a full virtual machine for an arm system

>>15606 You should check out Reverse Engineering for Beginners, it's free. It's a bit difficult to read in one pass, so you'll probably need to practice a bit so you stay motivated and things actually stick. If you want to do actual asm programming, not just patching or reading asm,there's Assembly Language Step by Step: Programming with Linux (3rd edition). However it's only x86/x86_64 and Linux, but once you know one assembly language, the rest are much easier to learn and understand (but they have big differences you should be aware of). Raspberry Pi run on ARM, so it can be fun to program in assembly on it. It's fun to see that objdump -D doesn't output that x86 juice you're used to...

>>12554 It's fantastic. Would rec, I've been learning with it on HTB for the last couple of weeks.

Can you recommend me any resources to learn radare2? I'm fed up with ghidras buggy bloated java codebase for small ctf challenges.

>>12555 Ghidra is an open source tool

I'm still very new to this and I don't know if I should be using radare2 or rizin. I'm assuming rizin forked because pancake is antagonistic to GUI frontends and/or the cutter devs were fed up that r2 changes kept breaking their project. By using rizin am I just using a version of r2 that's held back for a GUI I don't use? Is r2 a mess that rizin is cleaning up? Does any of this even matter?

Anything on API reversal?

>>17262 https://github.com/skylot/jadx

I'd like to add http://csapp.cs.cmu.edu/public/labs.html as a resource

>>17262 Use Apktool, it converts dexcode to a more human readable format.

>Reverse engineering thread >Lacking essential resources Here you go: https://microcorruption.com https://skullcode.com

In a previous deleted thread, a beginner Lainon asked for some learning sources, and someone replied to them with some books. can your please reshare them with us? thanks a lot in advance.

What's the current status on r2 vs rizin? Has one come out as the clear winner or do you still get an incomplete program no matter which you pick?

>>18365 no conclusion yet afaik, but iaito is in maintenance mode, so for a gui try cutter first

i tried using radare once years ago but it was written in C and segfaulted all the time, and reading their codebase was harder than actual reverse engineering

>>18625 (im saying this as an accomplished x86 reverse engineer btw)

>>18625 gb daniel

>>18620 ida didn't for years. Does it now?

>>18628 It has added it in 7.2 or 7.3

>>18619 Ghidr has gotten a lot better as of recent. But in my opinion it still lacks in a lot of aspects.. Here is some decompiled outputs of the CTF binary Betstar5000 (https://files.catbox.moe/bkaai4) All the decompiled outputs are at about 0xBCE. Binary ninja soykafs the bed completely... Ghidra changes the switch case functions to nested functions, which im not a fan of but thats more of a preference thing. The main importance is that at 0xBCE and 0xBEA, ida has the following lines: v9 = (char **)malloc(8 * (v7 + 6)); ... v2 = (void **)&v9[2 * i]; *v2 = malloc(4u); which Ghidra represents as: local_3c = malloc((local_44 + 6) * 8); ... ppvVar1 = (void **)(local_40 * 8 + (int)local_3c); pvVar2 = malloc(4); *ppvVar1 = pvVar2; This isn't a major thing, but it adds up. Clarity in code when reversing is super nice to have, and ghidra is sadly still a bit rusty in my eyes. Here is the full decompiled outputs of Ida, binary ninja and ghidra in case anyone wants to study it further: IDA: https://pastebin.com/raw/fRHFmxiY Ghidra: https://pastebin.com/raw/qgZpyrQL Bninja: https://pastebin.com/raw/atJCdi8f It call comes down to preference to be honest... And to be fair, I'm pretty biased. I first used Ghidra the day it got released, and back then it was bad to say the least... But gotta give it to them, it's gotten a lot better

>>18815 And to be fair, back in 2019 when it initially released, soykaf like pic related was common... Kind of made me stay away from Ghidra due to how soykaf it handled non-standard ways of coding. It could handle the basic GCC compiled binary, but as soon as you opened malware, CTF soykaf, obfuscated or packed binaries (or god forbid Go or Haskell binaries), Ghidra would soykaf the bed and spit out garbage like the pick related.. Still does to a degree, but gotten a lot better as mentioned

Hello lains, I have a small project I was hoping someone could help me with. Recently bought a Mibao M500 mp3 player, cheap and ok so far. When I mounted it, I found a few .LIB files. I assume they're the programs for the bluetooth and picture viewers. I have no experience with DOS or reverse-engineering DOS for that matter. I placed the files at ftp.lainon.org/files/mibao/. If I could see how they work, maybe we could make custom programs. Just wanted to see out of curiosity.

>>18820 The MUSIC.LIB seems a database for your music tags... Maybe they are not programs

I need your help lainons. Are you familiar with cobalt strike? A based dude reversed engineered it and uploaded it to github(which got taken down quickly) but it's available here https://web.archive.org/web/20201112173303/https://codeload.github.com/Freakboy/CobaltStrike/zip/master I can't for the life of me get it to work. After uncommenting the last lines(the jar manifest) on build.gradle, gradle is able to build the project, but I can't run the .jar cuz it's missing a class, but it wouldn't compile if it wasn't there. >inb4 retard yes. Halp pls. Take it as an exercise in reverse engineering.

What if reverse engineering all closed source programs

Howdy lainons, I am in an interesting position. I managed to land a junior role as a reverse engineer. They were willing to hire me out of college based on my internship performance and know that I do not have significant RE experience. Any recommended resources to learn RE quickly? I am currently in a role supporting the RE team more than doing "actual" reversing, but I will be transitioning to a more significant role as I build experience and I want to be prepared. Currently, I've been learning Ghidra (The Ghidra Book) and doing some crackmes. But I know that I still have a lot to learn, in particular in binary analysis and exploitation. Please recommend: books, courses, guided tutorials, etc. that will help me learn RE. Thanks friends

>>19542 I liked Reversing: Secrets of Reverse Engineering and Practical Malware Analysis. You might find some relevant resources from the MalDev thread >>14192

>>19542 https://anonfiles.com/rene66F6x8/REVERSING_WITH_IDA_PRO_FROM_SCRATCH_7z

Oalabs has great streams (his youtube is pretty inactive)

>>15735 >Reverse Engineering for Beginners, it's free >was free

>>20417 Can find latest on libgen

>>19713 OAlabs is good, I find it pretty approachable for a newbie but I do have cyber+CS background, seems to be more on youtube lately too

Hey anons I want to reverse engineer as I am bored and want a hobby Any advice on a general learning path?

I also don't know but I know the best way is to know how memory works and learn C, C++

>>21040 >>21039 Assembly. Create your own simple program adjacent to what you're actually interested in understanding and trace ita all the way to termination. Understand what is happening during both initialization and termination based on your created reference.

>>21039 Next time use the beginners questions thread >>33828 or ask in the reversing thread >>>/sec/12464 Go play with some crackmes, watch some videos, and get use to debugging decompiled and disassembled code. Ghidra is the standard tool now, but OllyDbg is also widely used. Liveoverflow's old reverse videos on YouTube are pretty good.

>>21039 Start with this => https://savannah.nongnu.org/projects/pgubook And stop making new threads for single questions.

>>19510 then being sued for violating eula

>>12464 What job i can take with RE except malware analytics?

Rendition 1.0 post everything related to reverse engineering here, including but not limited to guides, resources, personal projects, news about RE here's a handy guide to get you started: https://rentry.co/ReverseEngineering

>>12464 rentry.co/ReverseEngineering has some useful resources

Anyone got a newish version of the IDA sdk? Trying to write some plugins.

>>21259 Very cool, thank you. Do you have other tutorials like this?

>>21068 Security researcher, but good luck getting there

>>12464 https://web.archive.org/web/20210102125108/https://www.reddit.com/r/Piracy/comments/kmodia/improved_text_video_tutorial_on_how_to_rip_from/ not sure if this belongs here but since there's no /DRM-Free/ general, I'm dumping it here. "how to rip from amazon" it's outdated and can get you derezzed, but should set you on the right path towards your end goal. Happy cracking, lainon!

>Spend more $$$ on Pshop than some do on monthly mortgage >Spend time using and marketing it to other potential customers >Company pulls support, turns off activation servers, and leaves you hanging >Need to install software on Win11 >Only RE-lite experience (strngs/data editing) with hex editor. Estimated difficulty to RE my purchase & stop it phoning home and activate it so I can still use it on scale 1-10? Major obstacles you foresee as an RE specialist? (I know I could use a competitor product instead, or pirate -not viable as not personal use).

>>21177 As always, take precautions. `echo "aHR0cHM6Ly9hdXRoLmxvbC9pZGEvCg==" | base64 -d` `echo "SURBIFBybyA4LjMuMjMwNjA4OiBodHRwczovL3J1dHJhY2tlci5vcmcvZm9ydW0vdmlld3RvcGljLnBocD90PTY0NTQxOTMK" | base64 -d` `echo "SURBIFBybyA5LjAuMjQwODA3IEJldGE6IGh0dHBzOi8vcnV0cmFja2VyLm9yZy9mb3J1bS92aWV3dG9waWMucGhwP3Q9NjU2MDk1Nwo=" | base64 -d` Alternatively, the downloads for IDA Pro 9.0 have been archived in the Internet Archive: `echo "aHR0cHM6Ly9vdXQ1LmhleC1yYXlzLmNvbS9iZXRhOTBfNmJhOTIzL2lkYXBjXzkwX3g2NHdpbi5l eGUKaHR0cHM6Ly9vdXQ1LmhleC1yYXlzLmNvbS9iZXRhOTBfNmJhOTIzL2lkYXBjXzkwX3g2NGxp bnV4LnJ1bgpodHRwczovL291dDUuaGV4LXJheXMuY29tL2JldGE5MF82YmE5MjMvaWRhcGNfOTBf eDY0bWFjLmFwcC56aXAKaHR0cHM6Ly9vdXQ1LmhleC1yYXlzLmNvbS9iZXRhOTBfNmJhOTIzL2lk YXBjXzkwX2FybW1hYy5hcHAuemlwCmh0dHBzOi8vb3V0NS5oZXgtcmF5cy5jb20vYmV0YTkwXzZi YTkyMy9pZGFhcm1fOTBfeDY0d2luLmV4ZQpodHRwczovL291dDUuaGV4LXJheXMuY29tL2JldGE5 MF82YmE5MjMvaWRhYXJtXzkwX3g2NGxpbnV4LnJ1bgpodHRwczovL291dDUuaGV4LXJheXMuY29t L2JldGE5MF82YmE5MjMvaWRhYXJtXzkwX3g2NG1hYy5hcHAuemlwCmh0dHBzOi8vb3V0NS5oZXgt cmF5cy5jb20vYmV0YTkwXzZiYTkyMy9pZGFhcm1fOTBfYXJtbWFjLmFwcC56aXAKaHR0cHM6Ly9v dXQ1LmhleC1yYXlzLmNvbS9iZXRhOTBfNmJhOTIzL2lkYW1pcHNfOTBfeDY0d2luLmV4ZQpodHRw czovL291dDUuaGV4LXJheXMuY29tL2JldGE5MF82YmE5MjMvaWRhbWlwc185MF94NjRsaW51eC5y dW4KaHR0cHM6Ly9vdXQ1LmhleC1yYXlzLmNvbS9iZXRhOTBfNmJhOTIzL2lkYW1pcHNfOTBfeDY0 bWFjLmFwcC56aXAKaHR0cHM6Ly9vdXQ1LmhleC1yYXlzLmNvbS9iZXRhOTBfNmJhOTIzL2lkYW1p cHNfOTBfYXJtbWFjLmFwcC56aXAKaHR0cHM6Ly9vdXQ1LmhleC1yYXlzLmNvbS9iZXRhOTBfNmJh OTIzL2lkYXBwY185MF94NjR3aW4uZXhlCmh0dHBzOi8vb3V0NS5oZXgtcmF5cy5jb20vYmV0YTkw XzZiYTkyMy9pZGFwcGNfOTBfeDY0bGludXgucnVuCmh0dHBzOi8vb3V0NS5oZXgtcmF5cy5jb20v YmV0YTkwXzZiYTkyMy9pZGFwcGNfOTBfeDY0bWFjLmFwcC56aXAKaHR0cHM6Ly9vdXQ1LmhleC1y YXlzLmNvbS9iZXRhOTBfNmJhOTIzL2lkYXBwY185MF9hcm1tYWMuYXBwLnppcApodHRwczovL291 dDUuaGV4LXJheXMuY29tL2JldGE5MF82YmE5MjMvaWRhbTY4a185MF94NjR3aW4uZXhlCmh0dHBz Oi8vb3V0NS5oZXgtcmF5cy5jb20vYmV0YTkwXzZiYTkyMy9pZGFtNjhrXzkwX3g2NGxpbnV4LnJ1 bgpodHRwczovL291dDUuaGV4LXJheXMuY29tL2JldGE5MF82YmE5MjMvaWRhbTY4a185MF94NjRt YWMuYXBwLnppcApodHRwczovL291dDUuaGV4LXJheXMuY29tL2JldGE5MF82YmE5MjMvaWRhbTY4 a185MF9hcm1tYWMuYXBwLnppcAo=" | base64 -d`

>>19544 Can any lainon tell me the origin of that picture?