Reversing : Secrets of Reverse Engineering

, by Eilam, Eldad

Write a Review

Note: Supplemental materials are not guaranteed with Rental or Used book purchases.

ISBN: 9780764574818 | 0764574817
Cover: Paperback
Copyright: 4/15/2005

Rent

(Recommended)

$29.46

Term

Due

Price

Semester

Aug 2

$29.46

Quarter

Jul 19

$27.99

Short Term

Jun 21

$26.51

*This item is part of an exclusive publisher rental program and requires an additional convenience fee. This fee will be reflected in the shopping cart.
Buy Used

Usually Ships in 3-5 Business Days

$31.36
Buy New

Currently Available, Usually Ships in 24-48 Hours

$42.25

Summary

Author Biography

Supplemental Materials

* Offers a primer on advanced reverse-engineering, delving into "disassembly"-code-level reverse engineering-and explaining how to decipher assembly language

Foreword

vii

Acknowledgments

Introduction

xxiii

Part I Reversing 101

(138)

Foundations

(22)

What Is Reverse Engineering?

(1)

Software Reverse Engineering: Reversing

(1)

Reversing Applications

(5)

Security-Related Reversing

(1)

Malicious Software

(1)

Reversing Cryptographic Algorithms

(1)

Digital Rights Management

(1)

Auditing Program Binaries

(1)

Reversing in Software Development

(1)

Achieving Interoperability with Proprietary Software

(1)

Developing Competing Software

(1)

Evaluating Software Quality and Robustness

(1)

Low-Level Software

(4)

Assembly Language

(1)

Compilers

(1)

Virtual Machines and Bytecodes

(1)

Operating Systems

(1)

The Reversing Process

(1)

System-Level Reversing

(1)

Code-Level Reversing

(1)

The Tools

(3)

System-Monitoring Tools

(1)

Disassemblers

(1)

Debuggers

(1)

Decompilers

(1)

Is Reversing Legal?

(6)

Interoperability

(1)

Competition

(1)

Trade Secrets and Patents

(1)

The Digital Millenium Copyright Act

(2)

DMCA Cases

(1)

License Agreement Considerations

(1)

Code Samples & Tools

(1)

Conclusion

(2)

Low-Level Software

(44)

High-Level Perspectives

(11)

Program Structure

(2)

Modules

(1)

Common Code Constructs

(1)

Data Management

(1)

Variables

(1)

User-Defined Data Structures

(1)

Lists

(1)

Control Flow

(1)

High-Level Languages

(1)

C++

(1)

Java

(1)

Low-Level Perspectives

(7)

Low-Level Data Management

(2)

Registers

(1)

The Stack

(2)

Heaps

(1)

Executable Data Sections

(1)

Control Flow

(1)

Assembly Language 101

(9)

Registers

(2)

Flags

(1)

Instruction Format

(1)

Basic Instructions

(1)

Moving Data

(1)

Arithmetic

(1)

Comparing Operands

(1)

Conditional Branches

(1)

Function Calls

(1)

Examples

(1)

A Primer on Compilers and Compilation

(7)

Defining a Compiler

(1)

Compiler Architecture

(1)

Front End

(1)

Intermediate Representations

(1)

Optimizer

(1)

Back End

(1)

Listing Files

(1)

Specific Compilers

(1)

Execution Environments

(8)

Software Execution Environments (Virtual Machines)

(1)

Bytecodes

(1)

Interpreters

(1)

Just-in-Time Compilers

(1)

Reversing Strategies

(1)

Hardware Execution Environments in Modern Processors

(2)

Intel NetBurst

(1)

μops (Micro-Ops)

(1)

Pipelines

(2)

Branch Prediction

(1)

Conclusion

(1)

Windows Fundamentals

(40)

Components and Basic Architecture

(1)

Brief History

(1)

Features

(1)

Supported Hardware

(1)

Memory Management

(9)

Virtual Memory and Paging

(1)

Paging

(1)

Page Faults

(1)

Working Sets

(1)

Kernel Memory and User Memory

(1)

The Kernel Memory Space

(2)

Section Objects

(1)

VAD Trees

(1)

User-Mode Allocations

(1)

Memory Management APIs

(1)

Objects and Handles

(3)

Named objects

(2)

Processes and Threads

(5)

Processes

(1)

Threads

(1)

Context Switching

(1)

Synchronization Objects

(1)

Process Initialization Sequence

(1)

Application Programming Interfaces

(5)

The Win32 API

(2)

The Native API

(1)

System Calling Mechanism

(2)

Executable Formats

(10)

Basic Concepts

(2)

Image Sections

(1)

Section Alignment

(1)

Dynamically Linked Libraries

(1)

Headers

(2)

Imports and Exports

(1)

Directories

(4)

Input and Output

103

(2)

The I/O System

103

(1)

The Win32 Subsystem

104

(1)

Object Management

105

(1)

Structured Exception Handling

105

(2)

Conclusion

107

(2)

Reversing Tools

109

(30)

Different Reversing Approaches

110

(1)

Offline Code Analysis (Dead-Listing)

110

(1)

Live Code Analysis

110

(1)

Disassemblers

110

(6)

IDA Pro

112

(3)

ILDasm

115

(1)

Debuggers

116

(13)

User-Mode Debuggers

118

(1)

OllyDbg

118

(1)

User Debugging in WinDbg

119

(2)

IDA Pro

121

(1)

PEBrowse Professional Interactive

122

(1)

Kernel-Mode Debuggers

122

(1)

Kernel Debugging in WinDbg

123

(1)

Numega SoftICE

124

(3)

Kernel Debugging on Virtual Machines

127

(2)

Decompilers

129

(1)

System-Monitoring Tools

129

(2)

Patching Tools

131

(2)

Hex Workshop

131

(2)

Miscellaneous Reversing Tools

133

(5)

Executable-Dumping Tools

133

(1)

DUMPBIN

133

(4)

PEView

137

(1)

PEBrowse Professional

137

(1)

Conclusion

138

(1)

Part II Applied Reversing

139

(168)

Beyond the Documentation

141

(58)

Reversing and Interoperability

142

(1)

Laying the Ground Rules

142

(1)

Locating Undocumented APIs

143

(2)

What Are We Looking For?

144

(1)

Case Study: The Generic Table API in NTDLL.DLL

145

(51)

RtlInitializeGenericTable

146

(5)

RtlNumberGenericTableElements

151

(1)

RtlIsGenericTableEmpty

152

(1)

RtlGetElementGenericTable

153

(2)

Setup and Initialization

155

(4)

Logic and Structure

159

(2)

Search Loop 1

161

(2)

Search Loop 2

163

(1)

Search Loop 3

164

(1)

Search Loop 4

165

(1)

Reconstructing the Source Code

165

(3)

RtlInsertElementGenericTable

168

(2)

RtlLocateNodeGenericTable

170

(8)

RtlRealInsertElementWorker

178

(9)

Splay Trees

187

(1)

RtlLookupElementGenericTable

188

(5)

RtlDeleteElementGenericTable

193

(1)

Putting the Pieces Together

194

(2)

Conclusion

196

(3)

Deciphering File Formats

199

(44)

Cryptex

200

(1)

Using Cryptex

201

(1)

Reversing Cryptex

202

(5)

The Password Verification Process

207

(11)

Catching the ``Bad Password'' Message

207

(3)

The Password Transformation Algorithm

210

(3)

Hashing the Password

213

(5)

The Directory Layout

218

(9)

Analyzing the Directory Processing Code

218

(5)

Analyzing a File Entry

223

(4)

Dumping the Directory Layout

227

(1)

The File Extraction Process

228

(11)

Scanning the File List

234

(1)

Decrypting the File

235

(1)

The Floating-Point Sequence

236

(2)

The Decryption Loop

238

(1)

Verifying the Hash Value

239

(1)

The Big Picture

239

(2)

Digging Deeper

241

(1)

Conclusion

242

(1)

Auditing Program Binaries

243

(30)

Defining the Problem

243

(2)

Vulnerabilities

245

(17)

Stack Overflows

245

(2)

A Simple Stack Vulnerability

247

(2)

Intrinsic Implementations

249

(1)

Stack Checking

250

(4)

Nonexecutable Memory

254

(1)

Heap Overflows

255

(1)

String Filters

256

(1)

Integer Overflows

256

(2)

Arithmetic Operations on User-Supplied Integers

258

(2)

Type Conversion Errors

260

(2)

Case-Study: The IIS Indexing Service Vulnerability

262

(9)

CVariableSet::AddExtensionControlBlock

263

(4)

DecodeURLEscapes

267

(4)

Conclusion

271

(2)

Reversing Malware

273

(34)

Types of Malware

274

(3)

Viruses

274

(1)

Worms

274

(1)

Trojan Horses

275

(1)

Backdoors

276

(1)

Mobile Code

276

(1)

Adware/Spyware

276

(1)

Sticky Software

277

(1)

Future Malware

278

(2)

Information-Stealing Worms

278

(1)

BIOS/Firmware Malware

279

(1)

Uses of Malware

280

(1)

Malware Vulnerability

281

(1)

Polymorphism

282

(1)

Metamorphism

283

(2)

Establishing a Secure Environment

285

(1)

The Backdoor.Hacarmy.D

285

(19)

Unpacking the Executable

286

(4)

Initial Impressions

290

(1)

The Initial Installation

291

(3)

Initializing Communications

294

(2)

Connecting to the Server

296

(2)

Joining the Channel

298

(1)

Communicating with the Backdoor

299

(4)

Running SOCKS4 Servers

303

(1)

Clearing the Crime Scene

303

(1)

The Backdoor.Hacarmy.D: A Command Reference

304

(2)

Conclusion

306

(1)

Part III Cracking

307

(114)

Piracy and Copy Protection

309

(18)

Copyrights in the New World

309

(1)

The Social Aspect

310

(1)

Software Piracy

310

(4)

Defining the Problem

311

(1)

Class Breaks

312

(1)

Requirements

313

(1)

The Theoretically Uncrackable Model

314

(1)

Types of Protection

314

(4)

Media-Based Protections

314

(1)

Serial Numbers

315

(1)

Challenge Response and Online Activations

315

(1)

Hardware-Based Protections

316

(1)

Software as a Service

317

(1)

Advanced Protection Concepts

318

(1)

Crypto-Processors

318

(1)

Digital Rights Management

319

(2)

DRM Models

320

(1)

The Windows Media Rights Manager

321

(1)

Secure Audio Path

321

(1)

Watermarking

321

(1)

Trusted Computing

322

(2)

Attacking Copy Protection Technologies

324

(1)

Conclusion

324

(3)

Antireversing Techniques

327

(30)

Why Antireversing?

327

(1)

Basic Approaches to Antireversing

328

(1)

Eliminating Symbolic Information

329

(1)

Code Encryption

330

(1)

Active Antidebugger Techniques

331

(5)

Debugger Basics

331

(1)

The IsDebuggerPresent API

332

(1)

SystemKernelDebuggerInformation

333

(1)

Detecting SoftICE Using the Single-Step Interrupt

334

(1)

The Trap Flag

335

(1)

Code Checksums

335

(1)

Confusing Disassemblers

336

(8)

Linear Sweep Disassemblers

337

(1)

Recursive Traversal Disassemblers

338

(5)

Applications

343

(1)

Code Obfuscation

344

(2)

Control Flow Transformations

346

(9)

Opaque Predicates

346

(2)

Confusing Decompilers

348

(1)

Table Interpretation

348

(5)

Inlining and Outlining

353

(1)

Interleaving Code

354

(1)

Ordering Transformations

355

(1)

Data Transformations

355

(1)

Modifying Variable Encoding

355

(1)

Restructuring Arrays

356

(1)

Conclusion

356

(1)

Breaking Protections

357

(64)

Patching

358

(6)

Keygenning

364

(1)

Ripping Key-Generation Algorithms

365

(5)

Advanced Cracking: Defender

370

(45)

Reversing Defender's Initialization Routine

377

(10)

Analyzing the Decrypted Code

387

(9)

SoftICE's Disappearance

396

(1)

Reversing the Secondary Thread

396

(3)

Defeating the ``Killer'' Thread

399

(1)

Loading KERNEL32.DLL

400

(1)

Reencrypting the Function

401

(1)

Back at the Entry Point

402

(2)

Parsing the Program Parameters

404

(2)

Processing the Username

406

(1)

Validating User Information

407

(2)

Unlocking the Code

409

(1)

Brute-Forcing Your Way through Defender

409

(6)

Protection Technologies in Defender

415

(4)

Localized Function-Level Encryption

415

(1)

Relatively Strong Cipher Block Chaining

415

(1)

Reencrypting

416

(1)

Obfuscated Application/Operating System Interface

416

(1)

Processor Time-Stamp Verification Thread

417

(1)

Runtime Generation of Decryption Keys

418

(1)

Interdependent Keys

418

(1)

User-Input-Based Decryption Keys

419

(1)

Heavy Inlining

419

(1)

Conclusion

419

(2)

Part IV Beyond Disassembly

421

(58)

Reversing .NET

423

(34)

Ground Rules

424

(2)

.NET Basics

426

(3)

Managed Code

426

(2)

.NET Programming Languages

428

(1)

Common Type System (CTS)

428

(1)

Intermediate Language (IL)

429

(14)

The Evaluation Stack

430

(1)

Activation Records

430

(1)

IL Instructions

430

(3)

IL Code Samples

433

(1)

Counting Items

433

(3)

A Linked List Sample

436

(7)

Decompilers

443

(1)

Obfuscators

444

(1)

Renaming Symbols

444

(1)

Control Flow Obfuscation

444

(1)

Breaking Decompilation and Disassembly

444

(1)

Reversing Obfuscated Code

445

(10)

XenoCode Obfuscator

446

(2)

DotFuscator by Preemptive Solutions

448

(3)

Remotesoft Obfuscator and Linker

451

(1)

Remotesoft Protector

452

(1)

Precompiled Assemblies

453

(1)

Encrypted Assemblies

453

(2)

Conclusion

455

(2)

Decompilation

457

(22)

Native Code Decompilation: An Unsolvable Problem?

457

(2)

Typical Decompiler Architecture

459

(1)

Intermediate Representations

459

(4)

Expressions and Expression Trees

461

(1)

Control Flow Graphs

462

(1)

The Front End

463

(3)

Semantic Analysis

463

(1)

Generating Control Flow Graphs

464

(2)

Code Analysis

466

(10)

Data-Flow Analysis

466

(1)

Single Static Assignment (SSA)

467

(1)

Data Propagation

468

(2)

470

(1)

Data Type Propagation

471

(1)

Type Analysis

472

(1)

Primitive Data Types

472

(1)

Complex Data Types

473

(2)

Control Flow Analysis

475

(1)

Finding Library Functions

475

(1)

The Back End

476

(1)

Real-World IA-32 Decompilation

477

(1)

Conclusion

477

(2)

Appendix A Deciphering Code Structures

479

(40)

Appendix B Understanding Compiled Arithmetic

519

(18)

Appendix C Deciphering Program Data

537

(24)

Index

561

Please wait while the item is added to your bag...

FREE SHIPPING

Amazon no longer offers textbook rentals. We do!

Reversing : Secrets of Reverse Engineering

Summary

Author Biography

Table of Contents

Supplemental Materials