Hello, this is Dr. Miller, and this
is Episode thirteen point three of
Assembly.
Today, we're going to talk about
methods to reverse engineer
programs, and we'll do two different
standard styles.
There's an online method and then
there's a local method.
So online reversing.
So there are a couple of different
examples of online reverses.
So there's the online dissembler,
Dotcom, and then there's compiler
explorer. And these are just a
couple of examples.
One thing to keep in mind is if
you're going to do this type of
reverse engineering, you are taking
the code that you are trying to
reverse engineer or understand
and you're uploading it to website.
So that may or may not be good for
you or your project or your
organization.
And so that you have to take that
and make that into your decision of
what type of disassembly.
And we'll look at one of these in a
little bit.
And then we have local reversing.
So if you have a code that you can't
upload to a website because of
agreements like non-disclosure
agreements, then
you might want to set up a local
one. And it's actually usually a lot
faster in order to set that up and
you end up with pretty good results.
And so what you would do is you
determine your target operating
system. So whatever operating system
you want to write code and
understand, you need to pick
that. You need to also install a
compiler.
So the compiler that either you
think that they're using or a
compiler that you want to learn
about and then you need to install
some sort of disassembly and we're
just going to use some free open
source tools for
our examples.
So the process is you go and you
write some code in
your editor of Choice.
You then compile it and
then either be able to bring it to
your dissembler or just run
the dissembler locally and then you
go back to step one.
So as you modify the code,
you'll get some understanding of how
the different parts interact with
the compiler and the assembly
that gets generated for that.
So let's just have an example, and
we're going to use the two different
styles with this example.
So here I have the
godbolt disassembled or pulled
up.
And so in this window over here, I
go ahead and type my code, so the
code for this example
was a hello world program.
Pull this. This.
So it just prints off Hello World
and then does a return zero, and
so this provides a really nice
interface to understanding how
all the different pieces work.
And so every line that I highlight
here, it's going to show me the
disassembly for that line
of code.
So when I enter into my function, we
see a couple of
standard things.
So it's loading into DCX
a variable and then it's adding
E.S.P in order to make it on
a even byte boundary.
And then we can see it's pushing
some stuff on to the stack.
So we're pushing this pointer that X
minus four and then we have
our standard prolog
pushing X as that looks like it
might be used and then
allocating for some local
variable.
And then we can see when we go to do
the print statement, it's this
yellow right here and again, it's
subtracting some more from E.S.P
and then it's pushing on this
to zero.
And so that's a pointer to our
string, which has the letters,
hello, world inside of it.
And then it calls the Put's
function, which is going to print
that string off
and then it's correcting back to the
stack.
And so a lot of functions in Linux
require stock to be on even byte
boundaries. And so, um,
the reason why we have this subtract
in here is because the compiler is
trying to make it an even 16 bytes.
So it 12 here.
It's end up subtracting another
four that gives us 16
calls a function and then corrects
the stack back to sixteen.
And then we can see here our return
zero. Well, here is our
return value and then our closing
statement is going to do the
function epilog for that.
So correcting all the stack, doing a
leave and doing an alien.
The other example I'm going to do is
instead of just standard Linux.
So I have my program here again
typed in, and it's going to call the
puts and print off Hello World,
I can go ahead and compile it.
And I'm again, going to use the
minus M thirty two in order to make
sure that I get a 32 bit version,
right. So the process was edit my
file. I then compile it
and then I can run it through a disk
assembler.
So I'm just going to use object dump
for this example and
I end up running it through grep.
So we'll run it before we not
ingroup the first time so you can
see how that looks.
So object dump and then minus
D means disassemble and then
I would like to disassemble it as
intel syntax.
It's either Intel, AT&T,
Intel is what we've been learning
for the 86 portion of class
and then the the binary is called
edited out. So when you do JTC
and you don't give it an output
file, out, out is the default output
file.
And so when you say disassemble all,
it's going to disassemble every
single function that exists in
there. So we've got some in the VSS
we have, you know, a function called
dynamic. So there's a lot of
functions in here.
And what I'm really concerned about
is the main function.
Right. So this is my text that I'm
looking for in Maine.
And so what I generally do is just
run this through a grep command to
search for a pattern.
And the pattern, I'm going to look
for his main bracket,
colon.
And so what I'm going
to do is I'm going to search for
that pattern. And this is where the
function is defined.
And then the minus eight thirty
means give me thirty lines after
you find that match.
And 30 is just an approximate number
and I just use have to
adjust it to get to the
correct point.
So now I can see where my main
function is.
So here is my main.
And again, this isn't going to be as
nice as the online
dis assembler, but it is
a way that I can reverse engineer
code and sort of understand how
something works just by
building it inside the compiler and
then disassembling it so I can see
my functions.
But some of the things are going to
be a little bit different.
So, for example, here before
it, Sedlack zero for that
string right here, I get the actual
raw address.
And so you could look through that
raw address and say, OK, what does
that what string does that point
us to? And you could run this in
into a bugger.
You could put a breakpoint on this
line here and then go
and look and see what that function
is.
But as you go through and you
change, you can compare what you see
in this disassembly versus what
you see in another one after you've
modified something inside your file.
So today, we just briefly discussed
a couple of different ways to
reverse programs both online
and local, and
what we'll do in the future if we
want to look at them as well, open
them in a professional
dissembler, and then you can
see the sort of power that we get
with with those type of.
But the important part of the online
ones is that we are going to be able
to have instant feedback.
As soon as I type some code in
there, it'll automatically show
us what that is.
And we can directly correlate a line
of code with a line of code that's
in the is in a very
quick and efficient way.
So in the forward, in the future,
we're going to look at the different
sea constructs and then be able
to take those and disassemble them
so that we can understand how we
could do those directly
in assembly without
having to do them and use them in
the high level languages so we can
deconstruct it. So if there's
something that we don't know how to
do, we can figure out how
it works at the lowest level and
then be able to recognize that in
different assembly programs and
write it into new ones.
If you have questions, you can email
me millirems at U.A.,
unclutter Aidoo, and you can find me
on Twitter at millions 30.