Debuggers
Debugging an application is an integral part of the exploration process, a tool that the reverse engineer always has at hand. In the modern world, the debugger must support both Intel architectures - x64 and x86, and we will proceed from this.
We should also be able to debug code that runs in kernel mode. Such a need periodically arises, especially if you intend to search for zeroday vulnerabilities in the OS kernel or reverse virus drivers. There are two main contenders: x64dbg and WinDbg. The first debugger works in user mode, the second can debug code in kernel mode.
x64dbg
x64dbg.com
This modern debugger with a very nice interface is a worthy successor to OllyDbg. Supports both architectures - x64 and x86, has a lot of useful plugins.
![](https://telegra.ph/file/95e59bffe3a5122e73eb9.jpg)
![](https://telegra.ph/file/fafbac078b2210560955a.jpg)
Yes, of course, it is not without its flaws - it still has a few nasty bugs. However, it is actively supported and developed. Of course, because the debugger runs in user mode, it remains vulnerable to many debug detection techniques. But this disadvantage is partly offset by the variety of plugins for hiding the debugger.
X64dbg has a built-in decompiler, it supports displaying the code in the form of a graph, you can make breakpoints for reading, writing, executing and accessing, there is a built-in import reconstruction utility (both x64 and x86). In general, what to say - this debugger was used in narrow circles in order to defeat the notorious game defense Denuvo, and successfully copes with this task!
Why not OllyDbg
The OllyDbg debugger was not included in the collection - for the reason that it is already seriously outdated. It does not support modern OS or x64 architecture. The official website of the application announced the 64-bit version and even reported progress in its development, but the website itself was updated for the last time in 2014. Of course, a whole era is connected with OllyDbg, but, apparently, it has passed. Yes, and kernel mode debuggers have also diminished - the developers abandoned the Syser Kernel Debugger, and at one time it was the successor to SoftICE.
WinDbg
Official page
When it comes to debugging a kernel or driver, WinDbg is second to none. This debugger is maintained by Microsoft itself and is included in the Windows Driver Kit (WDK). It is currently the most up-to-date and powerful kernel debugging tool. There is no such nice interface as in x64dbg, but we also have little choice - other debuggers do not work in kernel mode.
![](https://telegra.ph/file/96da242ad068b862963f5.jpg)
WinDbg supports remote debugging and can download debug symbols directly from Microsoft servers. To quickly configure it for debugging the OS kernel inside virtual machines, there is a VirtualKD add-on. Of course, starting the reverse path with WinDbg is strictly contraindicated, but when you gain experience and start trying different interesting things, it becomes a necessity.
It is in WinDbg that you can easily see how certain system structures look, and easily disassemble NTAPI functions. Of course, they can also debug "regular" applications, but personally, I prefer to unpack such a powerful tool only when absolutely necessary!
Disassemblers
It's hard to imagine a reverse without static code analysis tools. Today, things are not much better with disassemblers than with debuggers, but still we can single out favorites in this area. The recognized standard in antivirus laboratories is the IDA Pro disassembler. The second most popular framework is the Radare2 reverse engineering framework (although many believe that Radare2 is on par with IDA).
IDA Disassembler
hex-rays.com/products/ida
There are two versions of IDA - paid (Pro) and free (Starter). The free version has been truncated in terms of the number of supported architectures - it only understands x86, moreover, it does not support plugins. The paid version is devoid of such restrictions: it supports an impressive number of processor
![](https://telegra.ph/file/7919d68e90f42ade644ac.jpg)
IDA has a built-in debugger, very simple in terms of a set of functions, but you will have to get used to its original interface. IDA can also be equipped with the Hex-Rays add-on - a decompiler of the application source code into C code. This is a very useful add-on that significantly speeds up program analysis.
Overall, IDA is a powerful and highly polished instrument that has evolved over the years. The only pity is that the professional version costs around $ 500-1000 depending on the type of license and is not sold to just about anyone. As a result, anybody gets out as best they can.
Radare2
rada.re
Radare2 was originally conceived as a regular hex editor, but today it is a whole framework that will help you debug and disassemble a wide variety of code, including device firmware, viruses and cracks.
![](https://telegra.ph/file/f998a0d4b0a836a55cdec.jpg)
Radare2 is a collection of console utilities that includes a debugger, disassembler, decompiler, hex editor, native compiler, binary comparison utility, and more. There is a separate add-on for working in the GUI called Cutter. It significantly improves the look of the framework and the usability of Radare.
The framework supports a large number of processors and platforms, thanks to which it can compete even with products such as IDA Pro. A huge plus is that the source code is open, the product is completely free and supported by the community.
Helper utilities
We have reviewed the basic tools, but the reverse is hard to imagine without packer analyzers, network monitors, hex editors, and a lot of auxiliary utilities. Let's take a closer look at the main ones.
Detect it Easy (DiE)
ntinfo.biz
It is an excellent program for identifying packers and has a very wide range of useful functions. For example, it allows you to view the entropy of file sections, which helps to visually determine the presence of encryption.
![](https://telegra.ph/file/4e71807b6b2c948ceae28.jpg)
It also has a resource viewer with the ability to dump to disk. You can easily view the import table, there is support for extensions and scripts. There are also settings for signature scanning methods, a file header viewer, and full support for PE and PE + formats.
There is only one minus - the program is rarely updated, but one cannot say that it was abandoned - a new version has been released recently!
ExeInfoPE
exeinfo-pe.en.uptodown.com
This is another packer and protector detector. It has a rather peculiar interface that not everyone will like. But the program is often updated, it is full of interesting features and has friendly hints for unpacking.
![](https://telegra.ph/file/33113ee4023e2f3779e7a.jpg)
All in all, I would recommend ExeInfoPE for beginners. It contains a database of automatic unpackers, and the program itself will tell you which tool to remove the hinged protection.
And of course, all the standard set of features is present here: a file header viewer, a section viewer, a hex viewer, and even a number of small built-in utilities such as TerminateProcess and others. Plus there is support for plugins.
HxD
It is often necessary to access a hard disk, memory, or application in binary mode. This is where hex editors come to the rescue, of which the HxD program is a prominent representative. It's free, constantly updated, supports popular formats, searches well, and has a nice interface. There are other nice features - for example, the ability to reliably delete files (that is, wipe with zeros). And the HxD also has a portable version to keep it conveniently on a flash drive.
![](https://telegra.ph/file/ccc68c9fb2531cab6eb2a.jpg)
Pestudio
winitor.com
This is a useful program tailored for malware analysis. It automatically scans the downloaded sample file on VirusTotal, interestingly displays the import table functions used in the test application, shows the application's virus signatures, the libraries used, and the PE file header information. Here you can also work with resources. In other words, it is a multifunctional anti-virus harvester for initial analysis of samples.
![](https://telegra.ph/file/3d1887ba2c8d283cb7b14.jpg)
PE-bear
PE-bear page on the developer blog
Another interesting viewer and editor for PE and PE + files. Contains an analyzer for packers and protectors, displays information about file headers, resources and sections. If desired, you can view the hex-representation of these sections and disassemble them into ordinary assembler mnemonics.
![](https://telegra.ph/file/757be27dc41bb8f88f802.jpg)
PE-bear has a nice interface and a nice utility for comparing files. The only drawback is that the program is rarely updated, although it is open source. So, if you find a bug in it, you can always fix it yourself.
Fakenet-NG
GitHub repository
This program is required in order to emulate the network. When examining malware samples, you often need to view all network requests: monitor requests to DNS and HTTP, sniff traffic, and determine the IP addresses of control servers (if it is, for example, a ransomware bot). The virtual machine, for obvious reasons, must be disconnected from the network, and if a virus notices this, it will not do everything that it usually does.
Fakenet-NG is constantly updated and supported, so this utility can be used on the latest operating systems.
![](https://telegra.ph/file/f7df2f485a2e8a257051a.jpg)
ProcessExplorer
Official page
It would be difficult to do without Sysinternals programs that monitor access to the file system and processes. ProcessExplorer will show all processes in the system in the form of a hierarchical tree so that you can easily see in what order they are spawned. In addition, you can find out which dynamic libraries are loaded into processes, priorities, digital signatures, processor usage, and much more.
![](https://telegra.ph/file/b4c52126b279c4a0ae826.jpg)
TCPView
Official page
A small program for monitoring network activity of applications. You can see which ports the application is opening (local and remote), as well as protocols, process IDs, and sent packet counters. All in all, one of the most useful tools in any hacking kit!
![](https://telegra.ph/file/c68c02b2d5b6fc144964c.jpg)
Resource Hacker
angusj.com/resourcehacker
Popular program for editing resources. Lets you edit manifest, icons, text dialog strings, cursor information, and more. You don't need to edit your application resources as often, but if you do need to, it's nice to have the right tool at hand.
![](https://telegra.ph/file/c46f2d5716063ffda7215.jpg)
Resource Hacker
Total
We have reviewed the basic set of utilities that are used to solve most of the tasks related to reverse engineering. I think that at first these applications will be enough for a beginner reverser. And your own list will grow with experience.
Many reverse engineers gradually come to the conclusion that they create the necessary highly specialized programs, plugins and scripts themselves. Not for all tasks the ready-made tools that make life easier.
Comments
Post a Comment