Reverser view to application security
Reverse Code Engineering
Speaker Info
Krishs Patil
Hold master degree in computer application
Computer programmer
Reverser
And hobbyist security researcher
Outline
 Introduction
 Reversing Process
 Tools andTechniques
 Reversing in different context (Practice)
 Lab demonstration
 Defeating Reverse Engineering
 Resources
Introduction
 “Reverse engineering is the process of extracting the
knowledge or design blueprints from anything man-
made”.
 It is usually conducted to obtain missing knowledge,
ideas and design philosophy when such information is
unavailable.
 In computer science, It is the process of dis-
assembling or de-compiling the binary code of
computer program for various purpose.
 Requires skills and understanding of computer and
software development
Introduction Cont…
Why reverse engineering…
different people do it for different purpose …
But, Specifically in the field of Cyber Security…
… If you want to be serious security researcher, you
must posses skills of reverse code engineering.
Reversing Process
Defining scope of reversing…
 System Reverse Engineering
 Code Reverse Engineering
 Data Reverse Engineering
 Protocol Reverse Engineering
Reversing Process Cont…
Setting up environment…
 Setup Isolated environment (VMware,Virtual Box)
 System monitoring (SysInternalTools)
 Static Analysis
 Dynamic Analysis (Debugging/Tracing)
Reversing Process Cont…
DisassemblingVs Decompiling…
 Native Code – Directly perform operations on CPU
(Compiled with C,C++,Delphi)
 IntermediateCode – Interpreter drives it to perform
operations on CPU
(Java byte code, MSIL)
Reversing Process Cont…
Program structure…
Higher level perspective …
 Modules
 Data
 Control flow
Lower level perspective …
 Just assembly language!!!
Reversing Process Cont…
So what I need to know prior reversing binary code ...
Just a computer and brain  would be enough but …
… mastering it might take time if you don’t know about
 Computer architecture
 Programming in Assembly Language and C,C++
 Operating System-Platform and HEX numbering
Assembly Language
 Lowest level in software
 Platform specific (IA-32, IA-64,AMD)
 Machine code (OpCode)  Assembly commands
 Assembler converts assembly program into machine
code that is executable by CPU
 Dis-assembler is the program that coverts machine
code into textual presentation of assembly
commands
 Mastering reversing without knowing assembly is
almost impossible.
Assembly Language
Assembly Language
Registers
 Internal memory in processor
 IA-32 has eight generic registers
(EAX,EBX,ECX,EDX,ESI,EDI,EBP and ESP)
 Floating point and debug registers
 Special register – EFLAGS for flag management
flags
 OF, SF, ZF, AF, PF, CF
Assembly Language
Basic Instructions
 MOV - data copying
 LEA – address loading (POINTER)
 ADD, SUB, MUL, DIV, IMUL, IDIV – arithmetic
 CMP,TEST – comparison
 CALL , RET – function call and Return
 J** - conditional branching
 PUSH/POP - stack management
 NOP – do nothing
System Calls
 Used as interface between application and operating
system.
 System calls ask OS to perform specific task
 Most operating system are written in “C” language,
so providing SYSTEM Calls as “C” api’s
- NIX system calls – unistd.h
-WINDOWS system calls - windows.h
 Studying OS platform and system calls is necessary
part of reverse engineering
PE – Portable Executable file
Tools and Techniques
 Various tools helps in reverse-engineering the binary
code/program.
 Compiler is the tool used to convert high level language
like C,C++ into machine code.
 Assembler is the tool used to convert pseudo-code written
specific to processor into machine code.
 At reverse Dis-Assembler and De-Compilers help us in
reversing the process, recovering the high level code from
machine code.
 Debuggers are the tools used to debug live running
program.
 Virtual machines might help in providing
protective/isolated environment for analysis.
Tools and Techniques Cont…
Broad category of tools are divided into two category.
Static AnalysisTools
-Tools helps us to analysis program without even
running it.
-Tools includes Dis-assembler and De-Compilers
Dynamic AnalysisTools
-Tools in this category helps us dive deep into
program by analyzing it while running it.
-Tools includes Debuggers, Loaders and System
Monitoring tools
Tools and Techniques Cont…
 Compilers
(VC compiler, GCC compiler suite, .NET framework)
 Assemblers
(MASM, NASM,TASM, FASM)
 Dis-assemblers and Debuggers
(IDAPro, OllyDbg, Immunity Debugger,WinDbg)
 Hypervisors
(VMWareWorkstation/Player,VirtualBox,QUEMU)
 System monitoring withSysInternals tools
 Hex Editors and Other system utilities
Tools and Techniques Cont…
Tools and Techniques Cont…
Tools and Techniques Cont…
Tools and Techniques Cont…
RCE in various context
Time to understand field work!!!
 Cracking (Illegal/Un-Ethical)
 Malware analysis
 Vulnerability analysis (exploit development)
 Clean house RE (ChineseWall)
 Recovering lost source code (legacy)
 Investigating and solving faults cause in released
software. (Microsoft global escalation support team)
Cool Huh …
Lets play around some practical reversing lab exercise
Lets see some cool stuff 
Lab – Cracking for serial.
 This is for purely demonstration and educational
purpose only.
 Anything you do to obtain or provide fake registration
key for software is considered cracking and a serious
offense.
 In lab we are going to study and recover serial key and
defeat registration mechanism by various ways.
Defeating RE
 Lot of research has been done, many ways to make it
harden for reversing process.
… But no solution is 100% perfect and secure.
Defeating RE Cont…
Software armoring
Obfuscation
“ deliberate act of creating obfuscated code, i.e.
source or machine code that is difficult for human to
understand” --Wikipedia
Defeating RE Cont…
Some techniques for anti-analysis …
 Packers (Compression)
 Protectors (Encryption)
 Anti-Debugging
 Garbage Code and Code Permutation
 Anti-Assembly
 Hypervisor/Emulator detection
Defeating RE Cont…
Defeating RE Cont…
Advanced technologies…
 Mutation
 CodeVirtualization
Resources
 REVERSING – secrets of reverse engineering (By
Eldad Eilam)
 Microsoft windows internals (By Mark Russinovich
and David Solomon)
 Reverseme.de – cool reverseme.exe collections
 InfoSec Institute Resources. – cool articles on security
 NtDebugging blog (Microsoft global escalation
support team) - fine gain exposure in windows insides
 And finally some good book on x86 assembly tut and
reference.
Questions???
Still there anything struggling in your mind.
Hope you enjoyed it.
Thank you!!!

More Related Content

PPTX
Revers engineering
PPT
Reverse engineering
DOCX
resume_v36
PPTX
Making reverse engineering fun
PPT
Embedded _c_
PDF
Standard embedded c
PPS
C programming session 14
PPTX
Embedded C workshop
Revers engineering
Reverse engineering
resume_v36
Making reverse engineering fun
Embedded _c_
Standard embedded c
C programming session 14
Embedded C workshop

What's hot (19)

PDF
WhitePaperTemplate
PPTX
Embedded c c++ programming fundamentals master
PDF
Codescape Debugger 8
PDF
C Programming For Embedded Systems
PDF
Reversing and Patching Machine Code
DOCX
Interview Question of Aspdotnet
PDF
ctchou-resume
PPT
bh-europe-01-clowes
PDF
ctchou-resume
PDF
Managed DirectX
PDF
ctchou-resume
PPT
linux device driver
PPT
Prasentation Managed DirectX
PDF
Shravani_Nerella
DOCX
Source vs object code
PDF
Introduction to Level Zero API for Heterogeneous Programming : NOTES
PPTX
Reverse Engineering 101
PDF
Tycs sem 5 asp.net notes unit 1 2 3 4 (2017)
WhitePaperTemplate
Embedded c c++ programming fundamentals master
Codescape Debugger 8
C Programming For Embedded Systems
Reversing and Patching Machine Code
Interview Question of Aspdotnet
ctchou-resume
bh-europe-01-clowes
ctchou-resume
Managed DirectX
ctchou-resume
linux device driver
Prasentation Managed DirectX
Shravani_Nerella
Source vs object code
Introduction to Level Zero API for Heterogeneous Programming : NOTES
Reverse Engineering 101
Tycs sem 5 asp.net notes unit 1 2 3 4 (2017)
Ad

Similar to Reverse code engineering (20)

PDF
Hacking with Reverse Engineering and Defense against it
PPTX
Intro to Reverse Engineering
PDF
Possibility of arbitrary code execution by Step-Oriented Programming by Hiroa...
PDF
Possibility of arbitrary code execution by Step-Oriented Programming
PPTX
The Hacking Games - Operation System Vulnerabilities Meetup 29112022
PDF
Embedded systems tools & peripherals
PPTX
T3_Embedded programing_07072022T3_Embedded programing_07072022.pptx
PPTX
VB2013 - Security Research and Development Framework
PPTX
Reverse engineering
PPTX
Embedded Systems
PDF
Oleksyk applied-anti-forensics
PPTX
2011.02.18 marco parenzan - case study. conversione di una applicazione for...
PDF
Porting your favourite cmdline tool to Android
PDF
Typhoon Managed Execution Toolkit
PDF
Software Reverse Engineering in a Security Context
PPT
Embedded systems
PPTX
Vxcon 2016
PPTX
Reverse Engineering - Protecting and Breaking the Software
DOCX
Resume
PDF
Unmanaged Parallelization via P/Invoke
Hacking with Reverse Engineering and Defense against it
Intro to Reverse Engineering
Possibility of arbitrary code execution by Step-Oriented Programming by Hiroa...
Possibility of arbitrary code execution by Step-Oriented Programming
The Hacking Games - Operation System Vulnerabilities Meetup 29112022
Embedded systems tools & peripherals
T3_Embedded programing_07072022T3_Embedded programing_07072022.pptx
VB2013 - Security Research and Development Framework
Reverse engineering
Embedded Systems
Oleksyk applied-anti-forensics
2011.02.18 marco parenzan - case study. conversione di una applicazione for...
Porting your favourite cmdline tool to Android
Typhoon Managed Execution Toolkit
Software Reverse Engineering in a Security Context
Embedded systems
Vxcon 2016
Reverse Engineering - Protecting and Breaking the Software
Resume
Unmanaged Parallelization via P/Invoke
Ad

Recently uploaded (20)

PDF
Workplace Software and Skills - OpenStax
PPTX
WiFi Honeypot Detecscfddssdffsedfseztor.pptx
DOC
UTEP毕业证学历认证,宾夕法尼亚克拉里恩大学毕业证未毕业
PPTX
Download Adobe Photoshop Crack 2025 Free
PPTX
Introduction to Windows Operating System
PDF
DuckDuckGo Private Browser Premium APK for Android Crack Latest 2025
PDF
Internet Download Manager IDM Crack powerful download accelerator New Version...
PDF
E-Commerce Website Development Companyin india
PDF
novaPDF Pro 11.9.482 Crack + License Key [Latest 2025]
DOCX
How to Use SharePoint as an ISO-Compliant Document Management System
PPTX
Cybersecurity-and-Fraud-Protecting-Your-Digital-Life.pptx
PDF
EaseUS PDF Editor Pro 6.2.0.2 Crack with License Key 2025
PPTX
Lecture 5 Software Requirement Engineering
PPTX
Python is a high-level, interpreted programming language
PPTX
Cybersecurity: Protecting the Digital World
PDF
Type Class Derivation in Scala 3 - Jose Luis Pintado Barbero
PDF
Visual explanation of Dijkstra's Algorithm using Python
PDF
AI-Powered Threat Modeling: The Future of Cybersecurity by Arun Kumar Elengov...
PDF
DNT Brochure 2025 – ISV Solutions @ D365
PDF
CCleaner 6.39.11548 Crack 2025 License Key
Workplace Software and Skills - OpenStax
WiFi Honeypot Detecscfddssdffsedfseztor.pptx
UTEP毕业证学历认证,宾夕法尼亚克拉里恩大学毕业证未毕业
Download Adobe Photoshop Crack 2025 Free
Introduction to Windows Operating System
DuckDuckGo Private Browser Premium APK for Android Crack Latest 2025
Internet Download Manager IDM Crack powerful download accelerator New Version...
E-Commerce Website Development Companyin india
novaPDF Pro 11.9.482 Crack + License Key [Latest 2025]
How to Use SharePoint as an ISO-Compliant Document Management System
Cybersecurity-and-Fraud-Protecting-Your-Digital-Life.pptx
EaseUS PDF Editor Pro 6.2.0.2 Crack with License Key 2025
Lecture 5 Software Requirement Engineering
Python is a high-level, interpreted programming language
Cybersecurity: Protecting the Digital World
Type Class Derivation in Scala 3 - Jose Luis Pintado Barbero
Visual explanation of Dijkstra's Algorithm using Python
AI-Powered Threat Modeling: The Future of Cybersecurity by Arun Kumar Elengov...
DNT Brochure 2025 – ISV Solutions @ D365
CCleaner 6.39.11548 Crack 2025 License Key

Reverse code engineering

  • 1. Reverser view to application security Reverse Code Engineering
  • 2. Speaker Info Krishs Patil Hold master degree in computer application Computer programmer Reverser And hobbyist security researcher
  • 3. Outline  Introduction  Reversing Process  Tools andTechniques  Reversing in different context (Practice)  Lab demonstration  Defeating Reverse Engineering  Resources
  • 4. Introduction  “Reverse engineering is the process of extracting the knowledge or design blueprints from anything man- made”.  It is usually conducted to obtain missing knowledge, ideas and design philosophy when such information is unavailable.  In computer science, It is the process of dis- assembling or de-compiling the binary code of computer program for various purpose.  Requires skills and understanding of computer and software development
  • 5. Introduction Cont… Why reverse engineering… different people do it for different purpose … But, Specifically in the field of Cyber Security… … If you want to be serious security researcher, you must posses skills of reverse code engineering.
  • 6. Reversing Process Defining scope of reversing…  System Reverse Engineering  Code Reverse Engineering  Data Reverse Engineering  Protocol Reverse Engineering
  • 7. Reversing Process Cont… Setting up environment…  Setup Isolated environment (VMware,Virtual Box)  System monitoring (SysInternalTools)  Static Analysis  Dynamic Analysis (Debugging/Tracing)
  • 8. Reversing Process Cont… DisassemblingVs Decompiling…  Native Code – Directly perform operations on CPU (Compiled with C,C++,Delphi)  IntermediateCode – Interpreter drives it to perform operations on CPU (Java byte code, MSIL)
  • 9. Reversing Process Cont… Program structure… Higher level perspective …  Modules  Data  Control flow Lower level perspective …  Just assembly language!!!
  • 10. Reversing Process Cont… So what I need to know prior reversing binary code ... Just a computer and brain  would be enough but … … mastering it might take time if you don’t know about  Computer architecture  Programming in Assembly Language and C,C++  Operating System-Platform and HEX numbering
  • 11. Assembly Language  Lowest level in software  Platform specific (IA-32, IA-64,AMD)  Machine code (OpCode)  Assembly commands  Assembler converts assembly program into machine code that is executable by CPU  Dis-assembler is the program that coverts machine code into textual presentation of assembly commands  Mastering reversing without knowing assembly is almost impossible.
  • 13. Assembly Language Registers  Internal memory in processor  IA-32 has eight generic registers (EAX,EBX,ECX,EDX,ESI,EDI,EBP and ESP)  Floating point and debug registers  Special register – EFLAGS for flag management flags  OF, SF, ZF, AF, PF, CF
  • 14. Assembly Language Basic Instructions  MOV - data copying  LEA – address loading (POINTER)  ADD, SUB, MUL, DIV, IMUL, IDIV – arithmetic  CMP,TEST – comparison  CALL , RET – function call and Return  J** - conditional branching  PUSH/POP - stack management  NOP – do nothing
  • 15. System Calls  Used as interface between application and operating system.  System calls ask OS to perform specific task  Most operating system are written in “C” language, so providing SYSTEM Calls as “C” api’s - NIX system calls – unistd.h -WINDOWS system calls - windows.h  Studying OS platform and system calls is necessary part of reverse engineering
  • 16. PE – Portable Executable file
  • 17. Tools and Techniques  Various tools helps in reverse-engineering the binary code/program.  Compiler is the tool used to convert high level language like C,C++ into machine code.  Assembler is the tool used to convert pseudo-code written specific to processor into machine code.  At reverse Dis-Assembler and De-Compilers help us in reversing the process, recovering the high level code from machine code.  Debuggers are the tools used to debug live running program.  Virtual machines might help in providing protective/isolated environment for analysis.
  • 18. Tools and Techniques Cont… Broad category of tools are divided into two category. Static AnalysisTools -Tools helps us to analysis program without even running it. -Tools includes Dis-assembler and De-Compilers Dynamic AnalysisTools -Tools in this category helps us dive deep into program by analyzing it while running it. -Tools includes Debuggers, Loaders and System Monitoring tools
  • 19. Tools and Techniques Cont…  Compilers (VC compiler, GCC compiler suite, .NET framework)  Assemblers (MASM, NASM,TASM, FASM)  Dis-assemblers and Debuggers (IDAPro, OllyDbg, Immunity Debugger,WinDbg)  Hypervisors (VMWareWorkstation/Player,VirtualBox,QUEMU)  System monitoring withSysInternals tools  Hex Editors and Other system utilities
  • 24. RCE in various context Time to understand field work!!!  Cracking (Illegal/Un-Ethical)  Malware analysis  Vulnerability analysis (exploit development)  Clean house RE (ChineseWall)  Recovering lost source code (legacy)  Investigating and solving faults cause in released software. (Microsoft global escalation support team)
  • 25. Cool Huh … Lets play around some practical reversing lab exercise Lets see some cool stuff 
  • 26. Lab – Cracking for serial.  This is for purely demonstration and educational purpose only.  Anything you do to obtain or provide fake registration key for software is considered cracking and a serious offense.  In lab we are going to study and recover serial key and defeat registration mechanism by various ways.
  • 27. Defeating RE  Lot of research has been done, many ways to make it harden for reversing process. … But no solution is 100% perfect and secure.
  • 28. Defeating RE Cont… Software armoring Obfuscation “ deliberate act of creating obfuscated code, i.e. source or machine code that is difficult for human to understand” --Wikipedia
  • 29. Defeating RE Cont… Some techniques for anti-analysis …  Packers (Compression)  Protectors (Encryption)  Anti-Debugging  Garbage Code and Code Permutation  Anti-Assembly  Hypervisor/Emulator detection
  • 31. Defeating RE Cont… Advanced technologies…  Mutation  CodeVirtualization
  • 32. Resources  REVERSING – secrets of reverse engineering (By Eldad Eilam)  Microsoft windows internals (By Mark Russinovich and David Solomon)  Reverseme.de – cool reverseme.exe collections  InfoSec Institute Resources. – cool articles on security  NtDebugging blog (Microsoft global escalation support team) - fine gain exposure in windows insides  And finally some good book on x86 assembly tut and reference.
  • 33. Questions??? Still there anything struggling in your mind.
  • 34. Hope you enjoyed it. Thank you!!!