舉報(bào) 
會(huì)員
Mastering Reverse Engineering
Ifyouwanttoanalyzesoftwareinordertoexploititsweaknessesandstrengthenitsdefenses,thenyoushouldexplorereverseengineering.ReverseEngineeringisahackerfriendlytoolusedtoexposesecurityflawsandquestionableprivacypractices.Inthisbook,youwilllearnhowtoanalysesoftwareevenwithouthavingaccesstoitssourcecodeordesigndocuments.Youwillstartoffbylearningthelow-levellanguageusedtocommunicatewiththecomputerandthenmoveontocoveringreverseengineeringtechniques.Next,youwillexploreanalysistechniquesusingreal-worldtoolssuchasIDAProandx86dbg.Asyouprogressthroughthechapters,youwillwalkthroughusecasesencounteredinreverseengineering,suchasencryptionandcompression,usedtoobfuscatecode,andhowtotoidentifyandovercomeanti-debuggingandanti-analysistricks.Lastly,youwilllearnhowtoanalyseothertypesoffilesthatcontaincode.Bytheendofthisbook,youwillhavetheconfidencetoperformreverseengineering.
目錄(271章)
倒序
- coverpage
- Title Page
- Packt Upsell
- Why subscribe?
- Packt.com
- Contributors
- About the author
- About the reviewers
- Packt is searching for authors like you
- Preface
- Who this book is for
- What this book covers
- To get the most out of this book
- Download the example code files
- Download the color images
- Conventions used
- Get in touch
- Reviews
- Preparing to Reverse
- Reverse engineering
- Technical requirements
- Reverse engineering as a process
- Seeking approval
- Static analysis
- Dynamic analysis
- Low-level analysis
- Reporting
- Tools
- Binary analysis tools
- Disassemblers
- Debuggers
- Monitoring tools
- Decompilers
- Malware handling
- Basic analysis lab setup
- Our setup
- Samples
- Summary
- Identification and Extraction of Hidden Components
- Technical requirements
- The operating system environment
- The filesystem
- Memory
- The registry system
- Typical malware behavior
- Persistence
- Run keys
- Load and Run values
- Startup values
- The Image File Execution Options key
- Malware delivery
- Instant messenger
- The computer network
- Media storage
- Exploits and compromised websites
- Software piracy
- Malware file properties
- Payload – the evil within
- Tools
- Autoruns
- The Process explorer
- Summary
- Further reading
- The Low-Level Language
- Technical requirements
- Binary numbers
- Bases
- Converting between bases
- Binary arithmetic
- Signed numbers
- x86
- Registers
- Memory addressing
- Endianness
- Basic instructions
- Opcode bytes
- Copying data
- MOV and LEA
- Arithmetic operations
- Addition and subtraction
- Increment and decrement instructions
- Multiplication and division instructions
- Other signed operations
- Bitwise algebra
- Control flow
- Stack manipulation
- Tools – builder and debugger
- Popular assemblers
- MASM
- NASM
- FASM
- x86 Debuggers
- WinDbg
- Ollydebug
- x64dbg
- Hello World
- Installation of FASM
- It works!
- Dealing with common errors when building
- Dissecting the program
- After Hello
- Calling APIs
- Common Windows API libraries
- Short list of common API functions
- Debugging
- Summary
- Further reading
- Static and Dynamic Reversing
- Assessment and static analysis
- Static analysis
- File types and header analysis
- Extracting useful information from file
- PEid and TrID
- python-magic
- file
- MASTIFF
- Other information
- PE executables
- Deadlisting
- IDA (Interactive Disassembler)
- Decompilers
- ILSpy – C# Decompiler
- Dynamic analysis
- Memory regions and the mapping of a process
- Process and thread monitoring
- Network traffic
- Monitoring system changes
- Post-execution differences
- Debugging
- Try it yourself
- Summary
- References
- Tools of the Trade
- Analysis environments
- Virtual machines
- Windows
- Linux
- Information gathering tools
- File type information
- Hash identifying
- Strings
- Monitoring tools
- Default command-line tools
- Disassemblers
- Debuggers
- Decompilers
- Network tools
- Editing tools
- Attack tools
- Automation tools
- Software forensic tools
- Automated dynamic analysis
- Online service sites
- Summary
- RE in Linux Platforms
- Setup
- Linux executable – hello world
- dlroW olleH
- What have we gathered so far?
- Dynamic analysis
- Going further with debugging
- A better debugger
- Setup
- Hello World in Radare2
- What is the password?
- Network traffic analysis
- Summary
- Further reading
- RE for Windows Platforms
- Technical requirements
- Hello World
- Learning about the APIs
- Keylogger
- regenum
- processlist
- Encrypting and decrypting a file
- The server
- What is the password?
- Static analysis
- A quick run
- Deadlisting
- Dynamic analysis with debugging
- Decompilers
- Summary
- Further reading
- Sandboxing - Virtualization as a Component for RE
- Emulation
- Emulation of Windows and Linux under an x86 host
- Emulators
- Analysis in unfamiliar environments
- Linux ARM guest in QEMU
- MBR debugging with Bochs
- Summary
- Further Reading
- Binary Obfuscation Techniques
- Data assembly on the stack
- Code assembly
- Encrypted data identification
- Loop codes
- Simple arithmetic
- Simple XOR decryption
- Assembly of data in other memory regions
- Decrypting with x86dbg
- Other obfuscation techniques
- Control flow flattening obfuscation
- Garbage code insertion
- Code obfuscation with a metamorphic engine
- Dynamic library loading
- Use of PEB information
- Summary
- Packing and Encryption
- A quick review on how native executables are loaded by the OS
- Packers crypters obfuscators protectors and SFX
- Packers or compressors
- Crypters
- Obfuscators
- Protectors
- SFX Self-extracting archives
- Unpacking
- The UPX tool
- Debugging though the packer
- Dumping processes from memory
- Memory dumping with VirtualBox
- Extracting the process to a file using Volatility
- How about an executable in its unpacked state?
- Other file-types
- Summary
- Anti-analysis Tricks
- Anti-debugging tricks
- IsDebuggerPresent
- Debug flags in the PEB
- Debugger information from NtQueryInformationProcess
- Timing tricks
- Passing code execution via SEH
- Causing exceptions
- A typical SEH setup
- Anti-VM tricks
- VM running process names
- Existence of VM files and directories
- Default MAC address
- Registry entries made by VMs
- VM devices
- CPUID results
- Anti-emulation tricks
- Anti-dumping tricks
- Summary
- Practical Reverse Engineering of a Windows Executable
- Things to prepare
- Initial static analysis
- Initial file information
- Deadlisting
- Debugging
- The unknown image
- Analysis summary
- Summary
- Further Reading
- Reversing Various File Types
- Analysis of HTML scripts
- MS Office macro analysis
- PDF file analysis
- SWF file analysis
- SWFTools
- FLASM
- Flare
- XXXSWF
- JPEXS SWF decompiler
- Summary
- Further reading
- Other Books You May Enjoy
- Leave a review - let other readers know what you think 更新時(shí)間：2021-06-10 19:41:16
推薦閱讀
- CTF實(shí)戰(zhàn)：技術(shù)、解題與進(jìn)階
- Kali Linux CTF Blueprints
- Practical Network Scanning
- 網(wǎng)絡(luò)空間安全：管理者讀物
- 等級(jí)保護(hù)測(cè)評(píng)理論及應(yīng)用
- 數(shù)字安全藍(lán)皮書：本質(zhì)屬性與重要特征
- Enterprise Cloud Security and Governance
- 黑客攻防與網(wǎng)絡(luò)安全從新手到高手（絕招篇）
- CTF那些事兒
- 安全防御入門手冊(cè)
- 空間群組密鑰管理研究：基于自主的深空DTN密鑰管理
- Mastering Malware Analysis
- 社會(huì)工程：防范釣魚欺詐（卷3）
- Instant OSSEC Host-based Intrusion Detection System
- Real-World SRE
- 數(shù)據(jù)中心安全防護(hù)技術(shù)
- 網(wǎng)絡(luò)安全滲透測(cè)試
- 商用密碼發(fā)展報(bào)告（2012—2017年）
- 業(yè)務(wù)安全關(guān)鍵技術(shù)與應(yīng)用實(shí)踐
- 安全之美
- 數(shù)字安全網(wǎng)絡(luò)戰(zhàn)
- 信息安全導(dǎo)論
- 無線網(wǎng)絡(luò)安全攻防實(shí)戰(zhàn)進(jìn)階
- Schneier的安全忠告
- 機(jī)器學(xué)習(xí)互聯(lián)網(wǎng)業(yè)務(wù)安全實(shí)踐
- 黑客攻防技術(shù)寶典：Web實(shí)戰(zhàn)篇(第2版)
- 黑客攻防從入門到精通（社會(huì)工程學(xué)篇）
- Cuckoo Malware Analysis
- 黑客攻防工具實(shí)戰(zhàn)從新手到高手（超值版）
- 博弈系統(tǒng)論：黒客行為預(yù)測(cè)與管理
