Dissecting the Unknown
Introduction to Reverse Engineering
Who are we?
2
Instagram: @dothidden_
What will we cover?
3
Instagram: @dothidden_
Disclaimer
ANY FORM OF TAMPERING WITH PROPRIETARY PRODUCTS CAN LEAD TO LEGAL CONSEQUENCES. WE WILL NOT BE RESPONSIBLE FOR YOUR ACTIONS!
STAY SAFE AND WASH YOUR HANDS!
4
A few examples
Reverse Engineering Examples
6
Reverse Engineering Examples
7
Reverse Engineering Examples
8
https://archive.org/stream/byte-magazine-1982-10/1982_10_BYTE_07-10_Computers_in_Business#page/n81/mode/2up
Reverse Engineering Examples
Other examples
9
Reverse Engineering Examples
Software RE:
10
Back to basics
How does a computer work?
12
How does a computer work?
13
How does a computer work?
14
How does a computer work?
15
How does code execute?
16
Input
Output
Central Processing Unit (CPU)
Registers
Arithmetic Logic Unit
Control Unit
Memory Unit
How does code execute?
17
Input
Output
“Hello!”
“Hi!”
How does code execute?
18
How does code execute?
19
How does code execute?
ARM
x64
RISC-V
20
How does code execute?
21
1101 1110 1010 1101 � 1011 1110 1110 1111
compression � (more) human readable
0xDEADBEEF
How does code execute?
Machine code instructions (x64) that print “Hello, world!” to standard output
55 48 89 e5 48 8d 05 ac 0e 00 00 48 89 c7 e8 f0 fe ff ff b8 00 00 00 00 5d c3
22
How does code execute?
55
48 89 e5
48 8d 05 ac 0e 00 00
48 89 c7
e8 f0 fe ff ff
b8 00 00 00 00
5d
c3
23
How does code execute?
55
48 89 e5
48 8d 05 ac 0e 00 00
48 89 c7
e8 f0 fe ff ff
b8 00 00 00 00
5d
c3
Instructions in x64 assembly that print “Hello, world!” to the console
push rbp
mov rbp, rsp
lea rax, [rip+0xeac]
mov rdi, rax
call 1050 <puts@plt>
mov eax, 0x0
pop rbp
ret
24
How does code execute?
Instructions in C that print “Hello, world!” to the console
int main() {
puts(“Hello, world!”);
return 0;
}
push rbp
mov rbp, rsp
lea rax, [rip+0xeac]
mov rdi, rax
call 1050 <puts@plt>
mov eax, 0x0
pop rbp
ret
25
How does code execute?
int main() {
puts(“Hello, world!”);
return 0;
}
push rbp
mov rbp, rsp
lea rax, [rip+0xeac]
mov rdi, rax
call 1050 <puts@plt>
mov eax, 0x0
pop rbp
ret
55 48 89 e5 48 8d 05 ac 0e 00 00 48 89 c7 e8 f0 fe ff ff b8 00 00 00 00 5d c3
compile
assemble
run
“Hello, world!”
55 48 89 …
libc
link
26
1
2
3
4
5
How does code execute?
> There are multiple standardised� file formats for executable files
> The most popular are:
> Portable Executable (PE, Windows)
> Executable and Linkable Format (ELF, Linux)
27
How does code execute?
28
How does code execute?
29
Tools of the craft
Decompilation
> The reverse of compilation
> A lot of information from the source code is lost during the compilation process
> So decompilation will (almost) NEVER show us the ORIGINAL source code
55 48 89 e5 48 8d 05 ac 0e 00 00 48 89 c7 e8 f0 fe ff ff b8 00 00 00 00 5d c3
push rbp
mov rbp, rsp
lea rax, [rip+0xeac]
mov rdi, rax
call 1050 <puts@plt>
mov eax, 0x0
pop rbp
ret
int main() {
puts(“Hello, world!”);
return 0;
}
Disassembly
Decompilation
31
Decompilation
> Disassemblers & Decompilers:
> objdump: https://man7.org/linux/man-pages/man1/objdump.1.html
> Cutter: https://cutter.re/
> Ghidra: https://ghidra-sre.org/
> IDA: https://hex-rays.com/ida-free/
> Binary Ninja: https://binary.ninja/
32
A look at Ghidra
Decompilation pane
Symbol tree
Assembly pane
33
A look at Ghidra
Decompilation pane
Symbol tree
Assembly pane
34
A look at Ghidra
Header
.bss
.data
.rodata
.text
> Header of the executable file
35
> Stores the executable machine code
> Stores global variables initialised to 0
> Stores mutable global variables
> Stores constants and immutable global data
A look at Ghidra
36
Alternative disassembly view which emphasises branching and higher level code flow
conditional branch
loop
Not all programs �are the same
Higher Level Languages
38
> Some languages do not (usually) compile to machine code
> Higher-level bytecode which can be fed into an interpreter or JIT
> The bytecode is usually available
public static void Main() {
Console.WriteLine(“hello world”);
}
Some kind of bytecode�
Java bytecode | DEX | CIL | MSIL
etc.
Runtime
JVM | CLR | ART
Compilation
Execution
Higher Level Languages
39
public static void Main() {
Console.WriteLine(“hello world”);
}
Some kind of bytecode�
Java bytecode | DEX | CIL | MSIL
etc.
Decompilation
> Bytecode can be reverse engineered
> a very common example?
Higher Level Languages
40
public static void Main() {
Console.WriteLine(“hello world”);
}
Some kind of bytecode�
Java bytecode | DEX | CIL | MSIL
etc.
Decompilation
> Bytecode can be reverse engineered
> a very common example?
> Android APKs
Android Packages (APKs)
41
https://medium.com/@banmarkovic/deep-insight-into-apk-1cd7f04a53f5
Glorified zip file
Android Packages (APKs)
> Tools for reverse engineering Android apps
> JADX: https://github.com/skylot/jadx
> APKtool: https://apktool.org/
> Android Studio: https://developer.android.com
> jtrace: https://newandroidbook.com/tools/jtrace.html
> many others: github.com/user1342/Awesome-Android-Reverse-Engineering
42
A look at JADX
43
Decompiled Java code
SMALI
Preventing RE
Obfuscation
45
https://www.ioccc.org/2020/endoh2/index.html
Obfuscation
46
.ps1
ELF
.js
Obfuscation
47
Deobfuscation
Further analysis
Dynamic Analysis
49
gdb
Case-by-Case
Malware analysis
51
Vulnerability Research
52
https://www.youtube.com/watch?v=QrtGOrSrVPQ
Dynamic Analysis - Tools
53
Other tools
54
CHALLENGE !
55
Follow us for more
56
Feedback
57
Short anonymous feedback form <3
Questions?
Thanks!
Survey time?
Annex
Annex A: Proces de boot
BIOS
Bootloader
Kernel
Apps
61
Annex B: Kernel
Kernel
> Kernel-ul este “sămânța” sau “nucleul” sistemului de operare
> Interacționează cu hardware-ul și gestionează memoria și procesele sistemului
62
Back to Basics
63