Good resource for learning how to debug & reverse engineer?

Discussion on reverse-engineering and debugging.
User avatar
ConanTheLibrarian
Posts: 56
Joined: Mon Mar 15, 2010 1:12 am
Location: USA
Contact:

Good resource for learning how to debug & reverse engineer?

Post by ConanTheLibrarian » Mon Mar 15, 2010 1:34 am

I am a malware remover working for a commercial company. I see new stuff all the time and figure out ways of removing malware online without going into any offline environment. However, I do not know how to debug or reverse engineer. I have no programing experience. Is there somewhere I can go or something I can read that will help educate me?

a_d_13
Global Moderator
Posts: 393
Joined: Sun Mar 07, 2010 3:31 am

Re: Good resource for learning how to debug & reverse engine

Post by a_d_13 » Mon Mar 15, 2010 1:51 am

http://forum.tuts4you.com/index.php is a good place for this - they have lots of tutorials, some with video, on how to learn to Reverse-Engineer. I would recommend you download some packers or malware, install them in a Virtual Machine, and then go ahead and try out debugging or unpacking. You should always do reverse-engineering in a Virtual Machine (VMWare, Microsoft Virtual PC, etc.)

Thanks,
--AD

__Genius__
Posts: 92
Joined: Sun Mar 14, 2010 8:20 am

Re: Good resource for learning how to debug & reverse engine

Post by __Genius__ » Mon Mar 15, 2010 8:38 am

Good point AD,
Furthermore you can pick up some books on reverse engineering like "Reversing : secrets of reverse engineering" and "IDA Pro book" from no starch press.
These can help you understand some concepts behind Operating System and better understanding of underlying architecture you're working on .
best regards,
-Genius
- Individuality

User avatar
GamingMasteR
Global Moderator
Posts: 228
Joined: Sun Mar 07, 2010 10:52 am

Re: Good resource for learning how to debug & reverse engine

Post by GamingMasteR » Mon Mar 15, 2010 11:04 am

Hi,

For malware analysis I suggest you to intense your reading/practising on threa fields :
- Unpacking & rebuilding executables memory dumps
- Obfuscated & virtualized binary code
- Anti-Xxx tricks (anti-debug/anti-trace/anti-blah blah)

You may also visit woodmann & ARTeam forums :
woodmann.com
accessroot.com

Good luck,
GM

Evilcry
Posts: 135
Joined: Tue Apr 20, 2010 6:10 pm

Re: Good resource for learning how to debug & reverse engine

Post by Evilcry » Tue Apr 20, 2010 6:35 pm

Hi,

Without any intent of spam or self proclamation, I've done a good amount of Malware Analysis papers that you can reach here:

http://evilcry.netsons.org/mw.html
http://evilcodecave.blogspot.com/

Regards,
Giuseppe 'Evilcry' Bonfa

User avatar
Buster_BSA
Posts: 390
Joined: Mon Mar 22, 2010 6:42 am

Re: Good resource for learning how to debug & reverse engine

Post by Buster_BSA » Fri Apr 23, 2010 5:44 pm

Evilcry wrote:Without any intent of spam or self proclamation, I've done a good amount of Malware Analysis papers that you can reach here:
Hey Evilcry!

Did you ever receive a mail I sent you?

Evilcry
Posts: 135
Joined: Tue Apr 20, 2010 6:10 pm

Re: Good resource for learning how to debug & reverse engine

Post by Evilcry » Thu Apr 29, 2010 7:48 am

Hi Buster,

Seems that mail has been lost, please resend to evilcry@gmail.com

Regards

0xC0000022L
Posts: 21
Joined: Fri Aug 05, 2011 9:12 pm

Re: Good resource for learning how to debug & reverse engine

Post by 0xC0000022L » Tue Oct 11, 2011 8:50 pm

Giuseppe, your name certainly rings a bell, but where did your blog go meanwhile? You retired your old one, but the new one seems to be inaccessible (or gone) as well. Any ideas anyone ...? :?

User avatar
Striker
Posts: 52
Joined: Thu Mar 10, 2011 2:22 pm
Location: Germany
Contact:

Re: Good resource for learning how to debug & reverse engine

Post by Striker » Fri Oct 14, 2011 1:20 pm

ARTeam does have nice tuts

check it out: http://www.accessroot.com/arteam/site/news.php

another awesome tuts: http://portal.b-at-s.net/download.php
Я люблю старые времена.

Image

xsk
Posts: 4
Joined: Sun Dec 04, 2011 6:06 pm

Re: Good resource for learning how to debug & reverse engine

Post by xsk » Sun Dec 04, 2011 6:28 pm

Step 1: Learn C/C++/Delphi etc. You can't reverse engineer if you can't forward engineer.
Step 2: Learn x86 assembly - http://opensecuritytraining.info/IntroX86.html (includes videos)
Step 3: Learn x86 architecture - http://opensecuritytraining.info/IntermediateX86.html (includes videos)
Step 4: Learn PE binary format - http://opensecuritytraining.info/LifeOfBinaries.html (includes videos)
Step 5: Learn about IDA & general RE thought process - http://opensecuritytraining.info/Introd ... ering.html (video pending)
Step 6: Learn about some stealth malware techniques - http://opensecuritytraining.info/Rootkits.html (includes videos)
Step 7: Learn more by encouraging other people to submit their own class material - http://opensecuritytraining.info/Why.html

Xeno

Post Reply