x86 Software Reverse-Engineering, Cracking, and Counter-Measures

Table of Contents....2

Title Page....13

Introduction....14

Who Should Read This Book....14

What to Expect from This Book....15

History....18

Legal....20

Chapter 1: Decompilation and Architecture....22

Decompilation....22

Lab 1: Decompiling....25

Architecture....26

Summary....35

Chapter 2: x86 Assembly: Data, Modes, Registers, and Memory Access....37

Introduction to x86....37

Assembly Syntax....39

Data Representation....40

Registers....47

Memory Access....51

Addressing Modes....55

Summary....58

Chapter 3: x86 Assembly: Instructions....59

x86 Instruction Format....59

x86 Instructions....60

Putting It All Together....71

Common x86 Instruction Mistakes....71

Summary....72

Chapter 4: Building and Running Assembly Programs....74

Output....74

System Calls....79

Building and Linking....81

objdump....86

Lab: Hello World....87

ASCII....89

Summary....91

Chapter 5: Understanding Condition Codes....93

Condition Codes....93

Summary....101

Chapter 6: Analyzing and Debugging Assembly Code....102

Binary Analysis....102

Breakpoints....104

gdb....105

Segmentation Faults....113

Lab: Shark Sim 3000....113

Tuning Out the Noise....114

Summary....115

Chapter 7: Functions and Control Flow....117

Control Flow....117

Logic Constructs in x86....121

Stack....138

Function Calls and Stack Frames....144

Summary....164

Chapter 8: Compilers and Optimizers....165

Finding Starting Code....165

Compilers....169

Summary....178

Chapter 9: Reverse Engineering: Tools and Strategies....179

Lab: RE Bingo....179

Basic REconnaissance....180

Reverse Engineering Strategy....188

Summary....190

Chapter 10: Cracking: Tools and Strategies....191

Key Checkers....191

Key Generators....196

Lab: Introductory Keygen....201

Procmon....201

Resource Hacker....208

Patching....215

Other Debuggers....217

Debugging with Immunity....219

Lab: Cracking with Immunity....228

Summary....229

Chapter 11: Patching and Advanced Tooling....230

Patching in 010 Editor....230

CodeFusion Patching....233

Cheat Engine....236

Lab: Cracking LaFarge....244

IDA Introduction....245

IDA Patching....256

Lab: IDA Logic Flows....259

Ghidra....260

Lab: Cracking with IDA....260

Summary....261

Chapter 12: Defense....262

Obfuscation....262

Lab: Obfuscation....272

Anti-Debugging....272

Lab: Anti-Debugging....277

Summary....278

Chapter 13: Advanced Defensive Techniques....279

Tamper-Proofing....279

Packing....281

Lab: Detecting and Unpacking....286

Virtualization....286

Cryptors/Decryptors....291

Summary....292

Chapter 14: Detection and Prevention....295

CRC....295

Code Signing....296

RASP....299

Allowlisting....301

Blocklisting....303

Remote Authentication....304

Lab: ProcMon....306

Summary....307

Chapter 15: Legal....308

U.S. Laws Affecting Reverse Engineering....308

Summary....315

Chapter 16: Advanced Techniques....316

Timeless Debugging....316

Summary....320

Chapter 17: Bonus Topics....322

Stack Smashing....322

Connecting C and x86....336

Summary....346

Conclusion....347

Index....350

Copyright....382

About the Authors....383

About the Technical Writer....384

About the Technical Editor....385

End User License Agreement....386

x86 Software Reverse-Engineering, Cracking, and Counter-Measures is centered around the world of disassembling software. It will start with the basics of the x86 assembly language, and progress to how that knowledge empowers you to reverse-engineer and circumvent software protections. No knowledge of assembly, reverse engineering, or software cracking is required.

The book begins with a bootcamp on x86, learning how to read, write, and build in the assembly that powers a massive amount of the world’s computers. Then the book will shift to reverse engineering applications using a handful of industry favorites such as IDA, Ghidra, Olly, and more. Next, we move to cracking with techniques such as patching and key generation, all harnessing the power of assembly and reverse engineering. Lastly, we’ll examine cracking from a defensive perspective. Providing learners with techniques to be a better defender of their own software, or knowledge to crack these techniques more effectively.

• Assembly: computer Architecture, x86, system calls, building and linking, ASCII, condition codes, GDB, control flow, stack, calling conventions
• Reverse Engineering: reconnaissance, strings, RE strategy, stripping, linking, optimizations, compilers, industry tools
• Cracking: patching, key checkers, key generators, resource hacking, dependency walking
• Defense: anti-debugging, anti-tamper, packing, cryptors/decryptors, whitelist, blacklist, RASP, code signing, obfuscation

A practical and hands-on resource for security professionals to hobbyists, this book is for anyone who wants to learn to take apart, understand, and modify black-box software. x86 Software Reverse-Engineering, Cracking, and Counter-Measures is a vital resource for security researchers, reverse engineers and defenders who analyze, research, crack or defend software applications.