Introduction to Reverse Engineering

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ https://www.cs.tau.ac.il/~tromer/courses/infosec11/lecture9.pdf +
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ Reverse engineering +
+++++++++++++++++++++++
is the process of discovering the technological principles of a device, object, or system through analysis of its structure, function, and operation.
aka: Reversing, RE, SRE

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ Tools of the Trade +
++++++++++++++++++++++
Debugger (Dynamic code analysis)
Disassembler (Static code analysis)
Hex Editor
PE Analyzer
Resource Editor

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ The Holy Grail: IDA-Pro +
+++++++++++++++++++++++++++
Started as an Interactive Dis
-Assembler, enabling user
interaction with the disassembler’s decisions.
Slowly evolved into an automatic RE tool:
– Built
-in full
-control script language
– Library recognition (including user
-generated)
– Function prototype information
– Display
– Propagate throughout the code
– Support for plug-ins
– Support for Python scripting
– Multi
-architecture, cross
-platform support
– Full incorporation with built-in and external debuggers

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ Reversing Malware +
+++++++++++++++++++++
Malware is comprised of the following building blocks:
– Infection Vector
– Concealment
– Operation
– Communications

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Check Point’s Anti-Malware Software Blade sits at the gateway
Therefore, communications interest us the most
A CrimeWareToolKit, originating in Russia.
Used mostly for stealing financial information, but will settle
for any other identity information and key logging...

Like any serious trojan, Spy Eye compresses its traffic and encrypts it
– Compression is performed using a public library (LZO)
– Encryption algorithm is proprietary