Reverse Engineering for Beginners: Free book | Hacker News Reader

Reverse Engineering for Beginners: Free book

beginners.re

276 pointsgalapago28 comments

For understanding the stack frame layout on x86-64, I found this post to be quite useful:

http://eli.thegreenplace.net/2011/09/06/stack-frame-layout-o...

You can also take a look at one article from my company: "64-bit Microsoft Office Applications Do Not Like Stack Walking" [1]

[1] http://blog.nektra.com/main/2014/04/23/64-bit-microsoft-offi...

Reverse engineering has come up a few times in the past few months:

Automated reverse engineering (of DRM) - https://news.ycombinator.com/item?id=7989490

Open-source debugger for Windows - https://news.ycombinator.com/item?id=8092273

After just visiting DEFCON and watching all the teams partake in CTF, this is what I want to learn. This is computing.

Or is it more relevant to say "this is HOW I want to learn"? I'd contend that one of the best ways for a person to learn about technology / engineering /computing / ... is to open things up and see how they work.

It's an especially good way for teenagers to learn, before they get bogged down in the exam regime of the later years of high school, as they have insatiable curiosity and a seemingly infinite amount of time. In the hands of a curious teenager, a smart phone and an open-ended mandate to break it, could be a pocket sized, multi-year course in nearly every aspect of electronics and programming.

As a regular CTF competitor for over 4 years now, I cannot emphasize the value in simply playing CTFs if you really want to learn this stuff. So many people seem to think there's a secret manual laying around that teaches you all that is involved in going from a compiled binary to a shell. The referenced book should be used as a resource for when you come across a new topic and need some help. If you want to get started here are some useful links.

http://smashthestack.org/

https://ctftime.org/

http://overthewire.org/wargames/

http://repo.shell-storm.org/CTF/

https://github.com/ctfs/write-ups

Thanks I have only ever done some of the OTW challanges but now I can try more :)

Sorry for the n00bish question, but I've never done any reversing. What does CTF stand for?

"Capture The Flag", typically the challenges will have a "flag" hidden somewhere that you have to locate.

Gotcha; that is what came to mind from playing FPS games, but figured it was probably something different in this context.

Thanks.

It stands for Capture The Flag, in these exercises it usually means completing a series of reverse engineering scenarios exploiting vulnerabilities in a simulated environment or possibly obtaining and holding root access to a host while others continue to search for and attack the host. The CTFTime FAQ has more information: https://ctftime.org/ctf-wtf/

Takes me back to high school. I used to sit in my room for hours working on keygennerators.

Same here. The good old days spent hanging in Fravia+, Woodmann and RETeam's forums..

same here :).I was trying to modify warez's group releases and showed my friends those were all my work :D

I have been contemplating taking up coding in my spare time, especially after the post about turning the $200 Chromebook into an el cheapo learning machine. This could be the starting block I have been searching for.

Reverse engineering is probably not the place to learn to code.

For high level languages, you are correct. However, lots of people learn assembly as they are learning to reverse engineer software.

That being said, I don't think the $200 Chromebook is going to cut it. Eventually he's going to want to run a Windows VM.

This is more of a knowledge expansion endeavor rather than career endeavor. Something to tinker with on the side was the appeal of the Ubuntu'd Chromebook in a threat here last week.

As far as learning and reversing goes, it has often been helpful to see how something is working while also attempting to make it work for me.

You should still be able to learn quite a bit with just the Chromebook. After reading the article, I'm thinking about getting one myself so I can get back into learning web development again.

Did you end up buying the Acer C720?

Not quite yet. I usually wait until the semester is in full swing before I make purchases. Both for time and money's sake.

That will be the one I more than likely go with. I was worried about 2GB of RAM coming from a Windows background, 2GB isnt anything. But apparently it runs fine in Ubuntu.

I remember how I spent a summer going through Lenas videos tutorials (look them up). They were really good and I learned a lot. Reverse engineering is an addictive thing.

Is there a good reversing toolset for linux? For instance this book recommends a windows only tool called Ida.

It's not Windows only

https://www.hex-rays.com/products/ida/debugger/index.shtml

it's still somewhat expensive though.

I believe there is a version of IDA which runs on Linux as well as MacOS

Try radare2 - it is opensource, and actively developing - http://rada.re

It also have a book - http://maijin.github.io/radare2book/ Not yet complete, but also evolving. Also you can read our blog http://radare.today/

And for the justice - there is another competitor - Hopper disasm too.

IDA is multi-platform. Its pretty expensive, but there's a free version that is definitely good enough while you are learning.

Does anyone know of a tool that can dump C++ vtables from 64 bit macho files?

You can try this https://github.com/lvc/vtable-dumper or even modify it for your needs

Reply on news.ycombinator.com