Reverse Engineering CS 166 Armen Boursalian 30 Apr 2018 Reverse - - PowerPoint PPT Presentation
Reverse Engineering CS 166 Armen Boursalian 30 Apr 2018 Reverse Engineering Take a product, understand how it works Usually limited to certain aspects, not full systems Need to know a little bit about a lot of topics to gain
○ Register teams for leaderboard (not required) ○ Check calendar for upcoming CTFs
○ Similar, but not live/timed events
○ Windows EXE? ○ Office document? ○ Script? ○ Encoded/encrypted blob?
○ Linux, command line-based
○ Windows, command line-based
○ OSX, command line-based
○ Windows, GUI ○ https://x64dbg.com/
○ Multiplatform, command line-based (vim-like) ○ Significant learning curve, but very powerful! ○ https://github.com/radare/radare2/
○ Windows, only ○ http://www.ollydbg.de/ ○ Becoming outdated, but tried, tested, and trusted
○ Linux, mainly ○ OllyDbg clone ○ https://github.com/eteran/edb-debugger
○ For scripting; useful in Python ○ https://github.com/aquynh/capstone/
○ CLI tool for dumping code and other artifacts out of ELF (Linux executable format) binaries
○ Also useful for parsing out the Mach-O executable file format for OSX binaries
○ Advanced Task Manager for Windows, allows manipulating running processes, injecting code, etc.
○ Process monitor for windows, allows viewing events generated by processes, e.g. files
○ Intercept and, optionally, manipulate network traffic ○ Extensible with plugins so that you can write a fake command and control server to communicate with malware
○ Excellent malware analysis introduction with labs/questions and answers to guide you ○ Good for reverse engineering in general, not just malware
○ @TheHackerNews ■ Random security news ○ @patrickwardle ■ Former NSA; active in exploit research and writes many free tools for OSX defense ○ @virustotal - online sandbox ○ @cyb3rops - Florian Roth (detections, malware/actor tracking)
○ Past challenges can be downloaded in bulk; no need to solve in sequence ○ Search online for peoples’ writeups if you need help (Reddit, etc.) ○ Check back (or check Reddit/Twitter) in June/July for news on this year’s challenge
○ Past challenges may or may not be available; check it out ○ Check back (or check Reddit/Twitter) in June/July for news on this year’s challenge
○ https://ctftime.org/ ○ 2 CTFs this weekend!
○ Similar, but not live/timed events
○ Inexpensive ○ Presentations are often peoples’ pet projects ○ Various competitions and amusements ○ During late summers
○ Expensive ○ Geared toward training sessions ○ During late summers
○ Enterprise security products ○ Mid-spring (just passed 2 weeks ago)