Hacker News Reader

Comment by cdnsteve | Hacker News Reader

Curious, are there specific security engineer professionals that do this type of work day to day? Doesn't seem like a regular security analyst type role. Seems very specialized. What is the field like, compensation and is this generally for consultants?

View on HN

Reverse engineering is one of the core skills employed in vulnerability research. If I'd glance behind the shoulder of a security researcher and not see an IDA or OllyDbg window open, I'd be very surprised.

Immunity debugger is quite useful as well.

Of course, if you really hate yourself, GDB on Windows is a thing...

If you're looking for a tool professionals actually use every day that requires you to hate yourself, WinDbg scores higher on both counts

What's wrong with WinDbg?

The same thing that's wrong with GDB. It's command based and most of the commands are hard to remember.

That's understandable. Recent versions of windbg have improved a bit in that regard. Most of the new functionality has been added to a more regular data model that you can browse through, and querying the data can be done using a "linq style" syntax so you can use programming knowledge instead of learning some arcane debugger commands. You still need to know the basics of flow control, but the shortcut keys for those are common with a number of other tools (e.g. F5 to run)

Their scripting engine is probably the worst programming language I have encountered (perl is readable by comparison).

That's why I was really extatic when Windbg devs introduced a standard script engine, only to learn later on that was JavaScript ...

Any specific complaint with JavaScript as the choice? The biggest downside I'm aware of it's the lack of direct support for 64bit numbers. What language would you have preferred? Python maybe?

Javascript is actually a sane choice for extending a debugger (event-based, async calls builtins, etc.) it's just that I'm not familiar with :p

I would have expected Windows to go with Powershell as their scripting engine, that's why I was surprised with Javascript.

Outside of defense, which is probably where 99% of it is still done, malware analysis is the biggest area. Some consulting firms will hire some people. Sounds neat and mysterious, but if you want a high paying career, learning C# or Java and grinding leetcode problems is going to be a far better use of your time. (Yes, yes, I'm sure we all "know a guy" that makes millions selling exploits)

Defense burns through reverse engineers as it gets the same type of people that want to make games for a living. Relatively easy to replace them after they leave.

If you search, there's a comment tptacek wrote here about the high daily rate professional consultant reverse engineers charge, considering how difficult it can be to problem solve around protections like codesurfer obfuscation https://news.ycombinator.com/item?id=3682361

It's "real" security work. Not related to the 'cyber security' degrees and certificaitons that have come up in recent years

If you don’t think defensive security is “real” security work, then you’re using a definition that very few people use.

Defensive security engineers I know very much employ RE on a daily basis.

It's real work, I think you misread the intent on the comment you replied to. While the work is real, it's not on the same scale of complexity and expertise as reverse engineering.

an analogy:

The school nurse putting a band-aid on your knee is "real" medical work, but that same nurse has no place in spinal surgery operating room.

The school nurse is every "certified ethical hacker" and "certified cybersecurity expert". The spinal surgeon is the reverse engineer. We need nurses, but we also need spinal surgeons more. Every spinal surgeon can practice as a school nurse, but (perhaps) 0.1% of school nurses can practice as a spinal surgeon.

Reply on news.ycombinator.com