Skip to content

Latest commit

 

History

History
107 lines (66 loc) · 2.74 KB

methodologies.md

File metadata and controls

107 lines (66 loc) · 2.74 KB
description cover coverY
10/27/2023
167

Methodologies

Reversing-101

Do this everytime you begin reversing (will be adding to this) :

  1. Hash file for records:
md5sum ./binary
sha256sum ./binary
  1. View the raw file:
hexdump -C ./binary | head -10
man ascii
  1. Parse bytes and show ONLY ASCII:
strings <binary>
  1. Obtain file signature:
file <binary>
  1. Document findings with screenshots, theory, and context in an attempt to further "paint the picture"
  2. Obtain symbols for imported functions of the binary:
readelf -W --dyn-sym ./binary
  1. Utilize objdump to view disassembly and examine specific ELF sections:
objdump -s -j .rodata ./binary
  1. Check symbols in the binary using nm:
nm <binary>

If desired, you can strip the binary of symbols manually with strip:

cp <binary-symbols> <binary-stripped>
strip <binary-stripped>
file <binary-stripped>
  1. Throw binary inside of static analysis tool of choice, Ghidra or IDA

Necessary Tasks

  • Check strings
  • Check symbols
  • Check for library imports if defined
  • If the architecture is known, look at the memory layout and look at what registers are used for what
  • Figure our how the architecture initializes the code e.g. vector table if symbols are not present
  • View the spec sheets of what you are reversing if possible
  • Look for unique data such as ID's, IP's, or MACs

Resources 📚

{% embed url="https://medium.com/@Asm0d3us/1-crackmes-one-beginner-friendly-reversing-challenges-6df94ea6b29d" %}

{% embed url="https://osandamalith.com/2019/02/11/linux-reverse-engineering-ctfs-for-beginners/" %}

{% embed url="https://wrongbaud.github.io/posts/ghidra-training/" %}

{% embed url="https://medium.com/swlh/intro-to-reverse-engineering-45b38370384" %}

{% embed url="https://medium.com/swlh/intro-to-reverse-engineering-part-2-4087a70104e9" %}

{% embed url="https://medium.com/swlh/intro-to-reverse-engineering-45b38370384/" %}

Videos

{% embed url="https://www.youtube.com/watch?v=ld2Y_5e4yZ4" %}

{% embed url="https://www.youtube.com/watch?v=fTGTnrgjuGA" %}

Tools

{% embed url="https://dogbolt.org/" %}

{% embed url="https://godbolt.org/" %}