Practical Reverse Engineering: x86, x64, ARM, Windows Kernel, Reversing Tools, and Obfuscation
x86, x64, ARM, Windows Kernel, Reversing Tools, and Obfuscation
Samenvatting
Analyzing how hacks are done, so as to stop them in the future
Reverse engineering is the process of analyzing hardware or software and understanding it, without having access to the source code or design documents. Hackers are able to reverse engineer systems and exploit what they find with scary results. Now the good guys can use the same tools to thwart these threats. Practical Reverse Engineering goes under the hood of reverse engineering for security analysts, security engineers, and system programmers, so they can learn how to use these same processes to stop hackers in their tracks.
The book covers x86, x64, and ARM (the first book to cover all three); Windows kernel–mode code rootkits and drivers; virtual machine protection techniques; and much more. Best of all, it offers a systematic approach to the material, with plenty of hands–on exercises and real–world examples.
Offers a systematic approach to understanding reverse engineering, with hands–on exercises and real–world examples
Covers x86, x64, and advanced RISC machine (ARM) architectures as well as deobfuscation and virtual machine protection techniques
Provides special coverage of Windows kernel–mode code (rootkits/drivers), a topic not often covered elsewhere, and explains how to analyze drivers step by step
Demystifies topics that have a steep learning curve
Includes a bonus chapter on reverse engineering tools
Practical Reverse Engineering: Using x86, x64, ARM, Windows Kernel, and Reversing Tools provides crucial, up–to–date guidance for a broad range of IT professionals.
Specificaties
Inhoudsopgave
<p>Chapter 1 x86 and x64 1</p>
<p>Register Set and Data Types 2</p>
<p>Instruction Set 3</p>
<p>Syntax 4</p>
<p>Data Movement 5</p>
<p>Exercise 11</p>
<p>Arithmetic Operations 11</p>
<p>Stack Operations and Function Invocation 13</p>
<p>Exercises 17</p>
<p>Control Flow 17</p>
<p>System Mechanism 25</p>
<p>Address Translation 26</p>
<p>Interrupts and Exceptions 27</p>
<p>Walk–Through 28</p>
<p>Exercises 35</p>
<p>x64 36</p>
<p>Register Set and Data Types 36</p>
<p>Data Movement 36</p>
<p>Canonical Address 37</p>
<p>Function Invocation 37</p>
<p>Exercises 38</p>
<p>Chapter 2 ARM 39</p>
<p>Basic Features 40</p>
<p>Data Types and Registers 43</p>
<p>System–Level Controls and Settings 45</p>
<p>Introduction to the Instruction Set 46</p>
<p>Loading and Storing Data 47<br /><br />LDR and STR 47</p>
<p>Other Usage for LDR 51</p>
<p>LDM and STM 52</p>
<p>PUSH and POP 56</p>
<p>Functions and Function Invocation 57</p>
<p>Arithmetic Operations 60</p>
<p>Branching and Conditional Execution 61</p>
<p>Thumb State 64</p>
<p>Switch–Case 65</p>
<p>Miscellaneous 67</p>
<p>Just–in–Time and Self–Modifying Code 67</p>
<p>Synchronization Primitives 67</p>
<p>System Services and Mechanisms 68</p>
<p>Instructions 70</p>
<p>Walk–Through 71</p>
<p>Next Steps 77</p>
<p>Exercises 78</p>
<p>Chapter 3 The Windows Kernel 87</p>
<p>Windows Fundamentals 88</p>
<p>Memory Layout 88</p>
<p>Processor Initialization 89</p>
<p>System Calls 92</p>
<p>Interrupt Request Level 104</p>
<p>Pool Memory 106</p>
<p>Memory Descriptor Lists 106</p>
<p>Processes and Threads 107</p>
<p>Execution Context 109</p>
<p>Kernel Synchronization Primitives 110</p>
<p>Lists 111</p>
<p>Implementation Details 112</p>
<p>Walk–Through 119</p>
<p>Exercises 123</p>
<p>Asynchronous and Ad–Hoc Execution 128</p>
<p>System Threads 128</p>
<p>Work Items 129</p>
<p>Asynchronous Procedure Calls 131</p>
<p>Deferred Procedure Calls 135</p>
<p>Timers 140</p>
<p>Process and Thread Callbacks 142</p>
<p>Completion Routines 143</p>
<p>I/O Request Packets 144</p>
<p>Structure of a Driver 146</p>
<p>Entry Points 147</p>
<p>Driver and Device Objects 149</p>
<p>IRP Handling 150</p>
<p>A Common Mechanism for User–Kernel Communication 150</p>
<p>Miscellaneous System Mechanisms 153</p>
<p>Walk–Throughs 155</p>
<p>An x86 Rootkit 156</p>
<p>An x64 Rootkit 172</p>
<p>Next Steps 178</p>
<p>Exercises 180</p>
<p>Building Confidence and Solidifying</p>
<p>Your Knowledge 180</p>
<p>Investigating and Extending Your Knowledge 182</p>
<p>Analysis of Real–Life Drivers 184</p>
<p>Chapter 4 Debugging and Automation 187</p>
<p>The Debugging Tools and Basic Commands 188</p>
<p>Setting the Symbol Path 189</p>
<p>Debugger Windows 189</p>
<p>Evaluating Expressions 190</p>
<p>Process Control and Debut Events 194</p>
<p>Registers, Memory, and Symbols 198</p>
<p>Breakpoints 208</p>
<p>Inspecting Processes and Modules 211</p>
<p>Miscellaneous Commands 214</p>
<p>Scripting with the Debugging Tools 216</p>
<p>Pseudo–Registers 216</p>
<p>Aliases 219</p>
<p>Language 226</p>
<p>Script Files 240</p>
<p>Using Scripts Like Functions 244</p>
<p>Example Debug Scripts 249</p>
<p>Using the SDK 257</p>
<p>Concepts 258</p>
<p>Writing Debugging Tools Extensions 262</p>
<p>Useful Extensions, Tools, and Resources 264</p>
<p>Chapter 5 Obfuscation 267</p>
<p>A Survey of Obfuscation Techniques 269</p>
<p>The Nature of Obfuscation: A Motivating Example 269</p>
<p>Data–Based Obfuscations 273</p>
<p>Control–Based Obfuscation 278</p>
<p>Simultaneous Control–Flow and Data–Flow</p>
<p>Obfuscation 284</p>
<p>Achieving Security by Obscurity 288</p>
<p>A Survey of Deobfuscation Techniques 289</p>
<p>The Nature of Deobfuscation: Transformation Inversion 289</p>
<p>Deobfuscation Tools 295</p>
<p>Practical Deobfuscation 312</p>
<p>Case Study 328</p>
<p>First Impressions 328</p>
<p>Analyzing Handlers Semantics 330</p>
<p>Symbolic Execution 333</p>
<p>Solving the Challenge 334</p>
<p>Final Thoughts 336</p>
<p>Exercises 336</p>
<p>Appendix Sample Names and Corresponding SHA1 Hashes 341</p>
<p>Index 343</p>