A Gentle Primer on Reverse Engineering

https://emily.st/2015/01/27/reverse-engineering/

by luu • 11 years ago

192 58 11 years ago

Kenji• 11 years ago

This is slightly offtopic but I find the vulgar example passwords amusing. I used to use a lot of vulgar language in my code but when you have to commit it and other people (e.g. your supervisor) read it, you have to be more careful.

pavel_lishin• 11 years ago

I usually try to make my passwords obscene if I suspect that they're being stored in something that can be reverted back to plain text, or if I suspect that someone may force me to give it to them (e.g., clueless IT team).

ics• 11 years ago

'------------...IsSomethingNobodyShouldHaveToRead', get as offensive as necessary and then include this 36-character salt. Like that?

logfromblammo• 11 years ago

If you're a fan of Abbott and Costello, and you believe someone might ask you for your password, try this one:

"I always forget, so I wrote it down."

A: What's your password?

B: "I always forget, so I wrote it down."

A: Where?

B: Where what?

A: Where did you write down your password?

B: I don't write down my password.

A: You just told me you did!

B: Why would I do that?

A: Because I was asking you for your password.

B: And I gave it to you.

A: Did you, or did you not, forget your password?

B: No.

A: So let's have it.

B: "I always forget, so I wrote it down."

A: Do you... ah... need to search your pockets?

B: Why?

A: To help you remember.

B: Remember what?

A: Your password.

B: No. It's very distinctive. I always remember it.

jkubicek2• 11 years ago

I find it especially amusing because "poop" and "butts" are my default "I need to enter some text here" strings.

seanp2k2• 11 years ago

This is why we have [foo, bar, baz, quux] and example.com though: https://www.iana.org/domains/reserved

busterarm• 11 years ago

Same here except I go much more vulgar.

It's such a hard habit to break. Also, if I can name a character in a videogame, it's almost always Dickbutt.

jkubicek2• 11 years ago

This was great. If there's ever a "Gentle Primer, pt. II" I'd love to see a walkthrough on replacing the existing hardcoded password with a different string.

mwcampbell• 11 years ago

Would have been a bit more realistic if the program had been stripped of symbols before disassembly. Still, the call to strcmp would be pretty obvious.

i5rider• 11 years ago

The title seems a bit misleading, e.g. one could reverse engineer source code into UML. Perhaps a more appropriate title would be: A Gentle Primer on Code disassembling.

jasode• 11 years ago

For what she's describing, "reverse engineering" is actually the more common phrase rather than "code disassembling".

If you search amazon.com, "reverse engineering" is in the titles of the first 2 books:

http://www.amazon.com/s/ref=nb_sb_noss_1?&field-keywords=rev...

The way most people use the terminology now, I'd say "reverse engineering" encompasses all the strategies of analyzing and unraveling the logic of assembler code. On the other hand "code disassembling" is more specific about using a tool such as IDA to disassemble the binary executable into assembly before the intellectual task reverse engineering begins.

revelation• 11 years ago

That's a bit misleading. Reverse engineering has, on the face, little to do with assembler of any sort; it's about understanding your target and choosing the best angle of attack to learn more about it. That often depends on how the target was produced in the first place. If it's written in C or C++, sure, go to the assembler. If it's some Adobe Air program that is really just a launcher for a SWF, well, you're not going to have much luck. Similarly, the application logic in a program like EVE Online is almost entirely written in Python; you wouldn't exactly know it from the outside, because they've wrapped all the native things they need. But then you won't learn much either just looking at the assembly of what are various layers and layers of wrappers.

shanemhansen• 11 years ago

I used emacs hexl-mode and http://support.amd.com/TechDocs/24594.pdf to edit a je to a jne which caused the program to think I put in the correct password. That was fun.

agumonkey• 11 years ago

The firstest trick in the book.

palmer_eldritch• 11 years ago

But it doesn't work anymore with the correct password...

I always found it was cleaner to either force (jmp) or remove (nopnop) the jump rather than inversing its condition. It's more explicit.

Also, in the real world, cracking's usually a bit more than finding the right jump to force/remove. Although, if it's enough to reach your goal, you should do it.

sdevlin2• 11 years ago

First: great article.

One nit, though. There's a subtle error in the main function:

    char* input;
    printf("Please input a word: ");
    scanf("%s", input);

Local variables are not automatically initialized in C, and we never assign input to point to any particular block of memory. This means it's probably pointing off to some random location - basically whatever address happened to be sitting on the stack when main was called. So when scanf writes the user password to input, it's going to go to some unpredictable location with unpredictable results. This could lead to code execution, or at least a straightforward denial of service.

zrail11• 11 years ago

The author addresses this in footnote #2. They're simplifying the C code to get to the point of the article faster.

farmdve4• 11 years ago

Hmm, that footnote was very hard to notice, so I was quick to point out these errors to the person who maintains the blog, only to get blocked by her on twitter. Not sure why go that far.

sdevlin2• 11 years ago

I don't really buy that this is a simplification. This code isn't even guaranteed to work on correct input.

A really simple fix would be just to use a character array.

EpicEng2• 11 years ago

Simplifying does not mean incorrect. Initializing the variable would not add appreciable complexity to the code. It's a snippet and should be fixed lest it make the author appear incompetent.

tptacek2• 11 years ago

The author was wrong, and then corrected their post. Why get indignant on their behalf?

sireat• 11 years ago

I would expect an article on reverse engineering to have correct C code.

If you think that having undefined behavior in your code is fine as long as it works for you, do not be surprised that one moment a vile dragon appears and starts spewing fire.

AlexeyBrin2• 11 years ago

C lacks a boolean type

This is false, as of C99 we have booleans in C, just include stdbool.h in your code, e.g.:

    #include <stdbool.h>
    
    ...

    bool test = true;

    ...

zrail11• 11 years ago

Let's look at the source of stdbool.h:

    #define true 1
    #define false 0

http://clang.llvm.org/doxygen/stdbool_8h_source.html

AlexeyBrin2• 11 years ago

I know that sdtbool actually contains macros for defining true and false, but _Bool is a new type in C99 ... But it is in the standard, implemented by all major compilers, so it should be used for the sake of clarity.

IMHO this:

    bool is_valid(char* password);

is more clear than this:

    int is_valid(char* password);

userbinator• 11 years ago

Given that more than half of that file is a copyright comment, and the other half basically has to follow a standard exactly, it almost makes me wonder if it meets the minimum threshold of creativity to be copyrightable.

samsaga2• 11 years ago

You're missing

   #define bool _Bool

Since bool wasn't reserved prior to C99, they use the _Bool keyword (which was reserved). [http://stackoverflow.com/questions/8724349/difference-betwee...]

delinka• 11 years ago

That simply explains the truth behind the words. Re-type-ing basic types into other names gives us the ability to share intent without commentary. A function returning 'bool' is intended to be treated as having two valid return values. A function returning int might be intended to return any of the large rage of values that int can support.

davenportw15• 11 years ago

Wouldn't be cleaner to implement is_valid like this:

  int is_valid(char* password) {
    return strcmp(password, "poop") == 0;
  }

codygman• 11 years ago

Maybe, but if/else is more approachable especially if you haven't seen that pattern before.

_nullandnull_• 11 years ago

Kind of sad that 75% of the comments in this thread are negative or pedantic. I work as a reverse engineer and I thought it was a good "gentle primer".

aptwebapps• 11 years ago

Whenever I read a comment like this of sufficient age I wish I could see a snapshot of the page at the time. Right now there's only 48 comments in total and I don't really notice much negativity. There's some back and forth nit-picking, do you consider that negative?

kbart• 11 years ago

Slightly off-topic. Could somebody recommend good resources on reverse engineering (especially C and Linux)? I'm writing C code for living, but binary level security is not my strong side and I wish to improve it.

Qworg• 11 years ago

I don't do this for a living, but an accessible resource is the UIUC ACM SIGMil guide. It is a little old, but relevant.

http://althing.cs.dartmouth.edu/local/www.acm.uiuc.edu/sigmi...

GotAnyMegadeth2• 11 years ago

Something interesting I found out whilst following these instructions: My version of linux has two different echo commands `echo` and `/bin/echo`.

The basic one cannot accept any flags and when I type `echo "\x01"` it prints `\x01`

The one in bin can accept flags, and requires the -e flag to interpret backslashes.

This changes the echo line of the program to this:

`/bin/echo -e "\x01"`

I found this out because it was changing the byte from 00 to 5C rather than 01, because 5C is the ASCII for \

zrail11• 11 years ago

Interesting. You might be seeing the bash (or other shell) `echo` builtin.

GotAnyMegadeth2• 11 years ago

$ which echo

echo: shell built-in command.

kschmit90• 11 years ago

FWIW I would wager that a male would not have to inb4 pedantic arguments. Also that a male would not get so much criticism in regards to nit picky things.

But maybe it's just a common trait of detail oriented programmer types to be pedantic?

zellyn• 11 years ago

Again (hackernews should just prepopulate my comment box with this text), if you enjoyed this, you'll probably enjoy https://microcorruption.com/ Surprised to see that it wasn't already mentioned, especially since one of the creators, tptacek, was active on this thread.

A Gentle Primer on Reverse Engineering

Related Stories