From Collaborative RCE Knowledge Library

Jump to: navigation, search

Windows Reversing Technique Info


Item name: Binary Auditor Crackmes/Reversemes
Rating: 5.0 (1 vote)
Author: Dr. TS and REA                        
Home URL: http://www.binary-auditing.com
Last updated:
Version (if appl.): 1.001
Direct D/L link: Locally archived copy
Description: The archive of the now defunct binary-auditor website. As far as I know, this is the most recently uploaded compilation. Included in the archive is the beginner guide.
Also listed in: Generic Reversing Technique Crackmes, Windows Reversing Technique Crackmes
More details: Click here for more details, images, related URLs & comments for this item! (or to update its entry)



Item name: CoDe_ReMe solution
Rating: 4.0 (1 vote)
Author: NullPointerException (aka AttonRand)                        
Home URL: N/A
Last updated: March 23, 2010
Version (if appl.): N/A
Direct D/L link: Locally archived copy
Description: This tutorial describes how to solve CoDe_ReMe by CoDe_InSiDe.
document format.
Also listed in: Windows Reversing Technique Crackmes
More details: Click here for more details, images, related URLs & comments for this item! (or to update its entry)



Item name: Subverting Windows7 x64 kernel with DMA attacks
Rating: 0.0 (0 votes)
Author: Christophe Devine, Damien Aumaitre                        
Home URL: https://bob.cat/
Last updated: July 4, 2010
Version (if appl.):
Direct D/L link: http://conference.hitb.org/hitbsecconf2010ams/materials/D2T2%20-%20Devine%20&%20Aumaitre%20-%20Subverting%20Windows%207%20x64%20Kernel%20with%20DMA%20Attacks.pdf
Description: This presentation will focus on concrete examples of compromising the Windows 7 x64 operating system, in effect bypassing two major security mecanisms: code signing and integrity verification (PatchGuard).

First, we’ll explain the internal structures of the operating system, and how they differ from previous versions. Then we describe how to alter these structures in order to gain control over the execution flow. The implementation of this attack is then presented, using an embedded soft-core MIPS CPU implemented on an FPGA PCMCIA/CardBus card.

Finally, we will conclude on the importance of new protection features included in recent CPUs, in particular the IOMMU and TXT.
Also listed in: Windows Internals Articles, Windows Reversing Technique Articles
More details: Click here for more details, images, related URLs & comments for this item! (or to update its entry)



Item name: TIEP Solution
Rating: 0.0 (0 votes)
Author: NullPointerException (aka AttonRand)                        
Home URL: N/A
Last updated: March 23, 2010
Version (if appl.): N/A
Direct D/L link: Locally archived copy
Description: This tutorial describes how to solve TIEP by CoDe_InSiDe.
Document format.
Also listed in: Windows Reversing Technique Crackmes
More details: Click here for more details, images, related URLs & comments for this item! (or to update its entry)



Item name: The Life of Binaries
Rating: 0.0 (0 votes)
Author: Xeno Kovah                        
Home URL: http://opensecuritytraining.info/
Last updated: September 6, 2011
Version (if appl.):
Direct D/L link: http://opensecuritytraining.info/LifeOfBinaries.html
Description: This is a 2 day class which is freely available to watch. You can also take the materials and use them to teach your own classes.

--


Topics include but are not limited to:
• Scanning and tokenizing source code.
• Parsing a grammar.
• Different targets for x86 assembly object files generation. (E.g. relocatable vs. position independent code).
• Linking object files together to create a well-formed binary.
• Detailed descriptions of the high level similarities and low level differences between the Windows PE and Linux ELF binary formats. (NOTE: we didn't get to this in the class where the video was recorded, but the materials are in the slides)
• How an OS loads a binary into memory and links it on the fly before executing it.

Along the way we discuss the relevance of security at different stages of a binary’s life, from the tricks that can be played by a malicious compiler, to how viruses really work, to the way which malware “packers” duplicate OS process execution functionality, to the benefit of a security-enhanced OS loader which implements address space layout randomization (ASLR).

Lab work includes:
• Manipulating compiler options to change the type of assembly which is output
• Manipulating linker options to change the structure of binary formats
• Reading and understanding PE files with PEView
• Reading and understanding ELF files with Readelf (NOTE: we didn't get to this in the class where the video was recorded, but the materials are in the slides)
• Using WinDbg and/or GDB to watch the loader dynamically link an executable
• Using Thread Local Storage (TLS) to obfuscate control flow and serve as a basic anti-debug mechanism
• Creating a simple example virus for PE
• Analyze the changes made to the binary format when a file is packed with UPX
• Using the rootkit technique of Import Address Table (IAT) hooking to subvert the integrity of a program’s calls to external libraries, allowing files to be hidden.

Knowledge of this material is recommended, but not required, for future classes such as Rootkits, but is required for reverse engineering. (Both also at http://opensecuritytraining.info/Training.html)
Also listed in: Generic Malware Analysis Tutorials, Generic Protection Technique Tutorials, Generic Reversing Technique Tutorials, Linux ELF Articles, Windows Internals Tutorials, Windows Malware Analysis Tutorials, Windows Reversing Technique Tutorials, Windows Tool Tutorials, Windows Unpacking Tutorials
More details: Click here for more details, images, related URLs & comments for this item! (or to update its entry)



Item name: Using OllyDbg as an API logger
Rating: 0.0 (0 votes)
Author: arebc                        
Home URL: http://www.woodmann.com/forum/showthread.php?13706-How-can-I-learn-to-make-an-auto-unpacking-script-for-programs-I-have-unpacked&p=86997&viewfull=1#post86997
Last updated: June 25, 2010
Version (if appl.):
Direct D/L link: N/A
Description: To use Ollydbg as an api logger right click > search for > All Intermodular Calls > right click on the calls > Set Log Breakpoint on every command > Select option to Log Value of expression on Condition.
Also listed in: Windows Reversing Technique Tidbits, Windows Tool Tidbits
More details: Click here for more details, images, related URLs & comments for this item! (or to update its entry)




RSS feed Feed containing all updates and additions for this category.

RSS feed Feed containing all updates and additions for this category, including sub-categories.


Subcategories

There are 4 subcategories to this category.




No items can be added directly to this category, please rather select one of its sub-categories above to submit an item!

Views