逆向工程实战：无源代码重写与安全审计

需积分: 20 172 浏览量更新于2024-07-19 1 收藏 8.48MB PDF 举报

"《逆向工程权威指南》是一本专注于高级逆向工程技术的英文著作，作者分享了自己在将编译后的代码重新转化为C/C++语言的经验，这个过程极其耗时且复杂，曾耗费他超过一年的时间来重构一个100KB的DLL。作者通过实际操作积累了许多逆向工程技巧，特别对于那些接手没有源代码的编译代码的人来说，这项服务具有一定的价值。然而，进行这种服务的前提是，必须是软件产品的合法所有者。书中不仅包含了详尽的逆向工程技术，还涉及二进制代码审计，即在他人发现漏洞之前寻找软件中的安全问题，这类似于渗透测试，但通常不依赖于源代码。同样，进行这项工作也需要合法的软件所有权。作者还提到，如果读者对书中使用OllyDbg作为示例工具感兴趣，他们正在考虑替换为其他调试器，因为尽管OllyDbg功能强大，但其图形用户界面和小字体可能不适合所有用户。此外，作者鼓励读者通过捐款支持他的项目，以便他能继续推进书籍编写和其他相关文章的创作。捐款链接可以在https://yurichev.com/donate.html找到。《逆向工程权威指南》是一本深度探讨逆向工程实践和技术的专业书籍，适合想要深入理解编译代码反汇编、审计与调试的开发者，同时也对作者的个人经验和业界洞见提供了宝贵的参考。"

CONTENTS

Preface

There are several popular meanings of the term “reverse engineering”:

1) The reverse engineering of software; researching compiled programs

2) The scanning of 3D structures and the subsequent digital manipulation required in order to duplicate

them

3) Recreating DBMS

structure

This book is about the ﬁrst meaning.

Prerequisites

Basic knowledge of the C PL

. Recommended reading: 11.1.3 on page 1009.

Exercises and tasks

…can be found at: http://challenges.re.

About the author

Dennis Yurichev is an experienced reverse engineer and programmer.

He can be contacted by email: dennis(@)yurichev.com or Skype:

dennis.yurichev.

Praise for Reverse Engineering for Beginners

• “Now that Dennis Yurichev has made this book free (libre), it is a contribution to the world of free

knowledge and free education.” Richard M. Stallman, GNU founder, software freedom activist.

• “It’s very well done .. and for free .. amazing.”

Daniel Bilar, Siege Technologies, LLC.

• “... excellent and free”

Pete Finnigan, Oracle RDBMS security guru.

• “... [the] book is interesting, great job!” Michael Sikorski, author of Practical Malware Analysis: The

Hands-On Guide to Dissecting Malicious Software.

• “... my compliments for the very nice tutorial!” Herbert Bos, full professor at the Vrije Universiteit

Amsterdam, co-author of Modern Operating Systems (4th Edition).

• “... It is amazing and unbelievable.” Luis Rocha, CISSP / ISSAP, Technical Manager, Network & Infor-

mation Security at Verizon Business.

• “Thanks for the great work and your book.” Joris van de Vis, SAP Netweaver & Security specialist.

Database Management Systems

Programming Language

twitter.com/daniel_bilar/status/436578617221742593

twitter.com/peteﬁnnigan/status/400551705797869568

xiv

CONTENTS

• “... [a] reasonable intro to some of the techniques.”

Mike Stay, teacher at the Federal Law En-

forcement Training Center, Georgia, US.

• “I love this book! I have several students reading it at the moment, [and] plan to use it in graduate

course.”

Sergey Bratus , Research Assistant Professor at the Computer Science Department at

Dartmouth College

• “Dennis @Yurichev has published an impressive (and free!) book on reverse engineering”

Tanel

Poder, Oracle RDBMS performance tuning expert .

• “This book is a kind of Wikipedia to beginners...” Archer, Chinese Translator, IT Security Researcher.

• “[A] ﬁrst-class reference for people wanting to learn reverse engineering. And it’s free for all.” Mikko

Hyppönen, F-Secure.

Thanks

For patiently answering all my questions: Andrey “herm1t” Baranovich, Slava “Avid” Kazakov, SkullC0DEr.

For sending me notes about mistakes and inaccuracies: Stanislav “Beaver” Bobrytskyy, Alexander Ly-

senko, Alexander “Solar Designer” Peslyak, Federico Ramondino, Mark Wilson, Xenia Galinskaya, Razikhova

Meiramgul Kayratovna, Anatoly Prokoﬁev, Kostya Begunets, Valentin “netch” Nechayev, Shell Rocket, Zhu

Ruijin, Changmin Heo, Vitor Vidal, Stijn Crevits, Jean-Gregoire Foulon

, Ben L., Etienne Khan, Norbert

Szetei

, Marc Remy, Michael Hansen, Derk Barten, The Renaissance

, Hugo Chan.

For helping me in other ways: Andrew Zubinski, Arnaud Patard (rtp on #debian-arm IRC), noshadow on

#gcc IRC, Aliaksandr Autayeu, Mohsen Mostafa Jokar.

For translating the book into Simpliﬁed Chinese: Antiy Labs (antiy.cn), Archer.

For translating the book into Korean: Byungho Min.

For translating the book into Dutch: Cedric Sambre (AKA Midas).

For translating the book into Spanish: Diego Boy, Luis Alberto Espinosa Calvo, Fernando Guida, Diogo

Mussi.

For translating the book into Portuguese: Thales Stevan de A. Gois, Diogo Mussi.

For translating the book into Italian: Federico Ramondino

, Paolo Stivanin

, twyK.

For translating the book into French: Florent Besnard

, Marc Remy

, Baudouin Landais, Téo Dacquet

For translating the book into German: Dennis Siekmeier

, Julius Angres

, Dirk Loser

, Clemens Tamme.

For translating the book into Polish: Kateryna Rozanova, Aleksander Mistewicz.

For proofreading: Alexander “Lstar” Chernenkiy, Vladimir Botov, Andrei Brazhuk, Mark “Logxen” Cooper,

Yuan Jochen Kang, Mal Malakov, Lewis Porter, Jarle Thorsen, Hong Xie.

Vasil Kolev

did a great amount of work in proofreading and correcting many mistakes.

For illustrations and cover art: Andy Nechaevsky.

Thanks also to all the folks on github.com who have contributed notes and corrections

Many L

X packages were used: I would like to thank the authors as well.

twitter.com/sergeybratus/status/505590326560833536

twitter.com/TanelPoder/status/524668104065159169

https://github.com/pixjuan

https://github.com/73696e65

https://github.com/TheRenaissance

https://github.com/pinkrab

https://github.com/paolostivanin

https://github.com/besnardf

https://github.com/mremy

https://github.com/T30rix

https://github.com/DSiekmeier

https://github.com/JAngres

https://github.com/PolymathMonkey

https://vasil.ludost.net/

https://github.com/dennis714/RE-for-beginners/graphs/contributors

CONTENTS

Donors

Those who supported me during the time when I wrote signiﬁcant part of the book:

2 * Oleg Vygovsky (50+100 UAH), Daniel Bilar ($50), James Truscott ($4.5), Luis Rocha ($63), Joris van

de Vis ($127), Richard S Shultz ($20), Jang Minchang ($20), Shade Atlas (5 AUD), Yao Xiao ($10), Pawel

Szczur (40 CHF), Justin Simms ($20), Shawn the R0ck ($27), Ki Chan Ahn ($50), Triop AB (100 SEK), Ange

Albertini (e10+50), Sergey Lukianov (300 RUR), Ludvig Gislason (200 SEK), Gérard Labadie (e40), Sergey

Volchkov (10 AUD), Vankayala Vigneswararao ($50), Philippe Teuwen ($4), Martin Haeberli ($10), Victor

Cazacov (e5), Tobias Sturzenegger (10 CHF), Sonny Thai ($15), Bayna AlZaabi ($75), Redﬁve B.V. (e25),

Joona Oskari Heikkilä (e5), Marshall Bishop ($50), Nicolas Werner (e12), Jeremy Brown ($100), Alexandre

Borges ($25), Vladimir Dikovski (e50), Jiarui Hong (100.00 SEK), Jim Di (500 RUR), Tan Vincent ($30), Sri

Harsha Kandrakota (10 AUD), Pillay Harish (10 SGD), Timur Valiev (230 RUR), Carlos Garcia Prado (e10),

Salikov Alexander (500 RUR), Oliver Whitehouse (30 GBP), Katy Moe ($14), Maxim Dyakonov ($3), Sebas-

tian Aguilera (e20), Hans-Martin Münch (e15), Jarle Thorsen (100 NOK), Vitaly Osipov ($100), Yuri Romanov

(1000 RUR), Aliaksandr Autayeu (e10), Tudor Azoitei ($40), Z0vsky (e10), Yu Dai ($10), Anonymous ($15),

Vladislav Chelnokov (($25), Nenad Noveljic (($50).

Thanks a lot to every donor!

mini-FAQ

Q: What are the prerequisites for reading this book?

A: A basic understanding of C/C++ is desirable.

Q: Should I really learn x86/x64/ARM and MIPS at once? Isn’t it too much?

A: Starters can read about just x86/x64, while skipping or skimming the ARM and MIPS parts.

Q: Can I buy a Russian or English hard copy/paper book?

A: Unfortunately, no. No publisher got interested in publishing a Russian or English version so far. Mean-

while, you can ask your favorite copy shop to print and bind it.

Q: Is there an epub or mobi version?

A: No. The book is highly dependent on TeX/LaTeX-speciﬁc hacks, so converting to HTML (epub/mobi are

a set of HTMLs) would not be easy.

Q: Why should one learn assembly language these days?

A: Unless you are an OS

developer, you probably don’t need to code in assembly—the latest compilers

(2010s) are much better at performing optimizations than humans

Also, the latest CPU

s are very complex devices, and assembly knowledge doesn’t really help towards

understand their internals.

That being said, there are at least two areas where a good understanding of assembly can be helpful:

First and foremost, for security/malware research. It is also a good way to gain a better understanding of

your compiled code while debugging. This book is therefore intended for those who want to understand

assembly language rather than to code in it, which is why there are many examples of compiler output

contained within.

Q: I clicked on a hyperlink inside a PDF-document, how do I go back?

A: In Adobe Acrobat Reader click Alt+LeftArrow. In Evince click “<” button.

Q: May I print this book / use it for teaching?

A: Of course! That’s why the book is licensed under the Creative Commons license (CC BY-SA 4.0).

Q: Why is this book free? You’ve done great job. This is suspicious, as with many other free things.

A: In my own experience, authors of technical literature write mostly for self-advertisement purposes. It’s

not possible to make any decent money from such work.

Q: How does one get a job in reverse engineering?

Operating System

A very good text on this topic: [Agner Fog, The microarchitecture of Intel, AMD and VIA CPUs, (2016)]

Central Processing Unit

xvi

CONTENTS

A: There are hiring threads that appear from time to time on reddit, devoted to RE

(2016). Try looking

there.

A somewhat related hiring thread can be found in the “netsec” subreddit: 2016.

Q: How can I learn programming in general?

A: Mastering both C and LISP languages makes programmer’s life much, much easier. I would recommend

solving exercises from [Brian W. Kernighan, Dennis M. Ritchie, The C Programming Language, (1988)] and

SICP

Q: I have a question...

A: Send it to me by email (dennis(@)yurichev.com).

About the Korean translation

In January 2015, the Acorn publishing company (www.acornpub.co.kr) in South Korea did a huge amount

of work in translating and publishing this book (as it was in August 2014) into Korean.

It’s available now at their website.

The translator is Byungho Min (twitter/tais9). The cover art was done by the artistic Andy Nechaevsky, a

friend of the author: facebook/andydinka. Acorn also holds the copyright to the Korean translation.

So, if you want to have a real book on your shelf in Korean and want to support this work, it is now available

for purchase.

About the Persian/Farsi translation

In 2016 the book was translated by Mohsen Mostafa Jokar (who is also known to Iranian community for

his translation of Radare manual

). It is available on the publisher’s website

(Pendare Pars).

Here is a link to a 40-page excerpt: https://beginners.re/farsi.pdf.

National Library of Iran registration information: http://opac.nlai.ir/opac-prod/bibliographic/4473995.

About the Chinese translation

In April 2017, translation to Chinese was completed by Chinese PTPress. They are also the Chinese trans-

lation copyright holders.

The Chinese version is available for order here: http://www.epubit.com.cn/book/details/4174. A par-

tial review and history behind the translation can be found here: http://www.cptoday.cn/news/detail/

3155.

The principal translator is Archer, to whom the author owes very much. He was extremely meticulous (in

a good sense) and reported most of the known mistakes and bugs, which is very important in literature

such as this book. The author would recommend his services to any other author!

The guys from Antiy Labs has also helped with translation. Here is preface written by them.

reddit.com/r/ReverseEngineering/

Structure and Interpretation of Computer Programs

http://rada.re/get/radare2book-persian.pdf

http://goo.gl/2Tzx0H

xvii

Chapter 1

Code Patterns

1.1 The method

When the author of this book ﬁrst started learning C and, later, C++, he used to write small pieces of

code, compile them, and then look at the assembly language output. This made it very easy for him to

understand what was going on in the code that he had written.

. He did this so many times that the

relationship between the C/C++ code and what the compiler produced was imprinted deeply in his mind.

It’s now easy for him to imagine instantly a rough outline of a C code’s appearance and function. Perhaps

this technique could be helpful for others.

By the way, there is a great website where you can do the same, with various compilers, instead of

installing them on your box. You can use it as well: https://gcc.godbolt.org/.

Exercises

When the author of this book studied assembly language, he also often compiled small C functions and

then rewrote them gradually to assembly, trying to make their code as short as possible. This probably is

not worth doing in real-world scenarios today, because it’s hard to compete with the latest compilers in

terms of eﬃciency. It is, however, a very good way to gain a better understanding of assembly. Feel free,

therefore, to take any assembly code from this book and try to make it shorter. However, don’t forget to

test what you have written.

Optimization levels and debug information

Source code can be compiled by diﬀerent compilers with various optimization levels. A typical compiler

has about three such levels, where level zero means that optimization is completely disabled. Optimization

can also be targeted towards code size or code speed. A non-optimizing compiler is faster and produces

more understandable (albeit verbose) code, whereas an optimizing compiler is slower and tries to produce

code that runs faster (but is not necessarily more compact). In addition to optimization levels, a compiler

can include some debug information in the resulting ﬁle, producing code that is easy to debug. One of the

important features of the ´debug’ code is that it might contain links between each line of the source code

and its respective machine code address. Optimizing compilers, on the other hand, tend to produce output

where entire lines of source code can be optimized away and thus not even be present in the resulting

machine code. Reverse engineers can encounter either version, simply because some developers turn

on the compiler’s optimization ﬂags and others do not. Because of this, we’ll try to work on examples of

both debug and release versions of the code featured in this book, wherever possible.

Sometimes some pretty ancient compilers are used in this book, in order to get the shortest (or simplest)

possible code snippet.

In fact, he still does this when he can’t understand what a particular bit of code does.

剩余1076页未读，继续阅读

ReZerou

粉丝: 19
资源: 5

逆向工程实战：无源代码重写与安全审计

逆向工程权威指南 上下两册完整超清版

逆向工程权威指南.上册

逆行工程核心原理pdf、代码以及编译好的测试软件

逆向工程权威指南 英文 pdf

逆向工程权威指南pdf csdn

idapro权威指南第三版 pdf

mybatis的逆向工程

逆向工程shell和powershell

hibernate逆向工程工具

列出值得推荐的逆向工程书籍、需要学习的逆向工程工具、逆向工程社区论坛

最新资源

逆向工程权威指南上下两册完整超清版

逆向工程权威指南英文 pdf