Today's meeting provided an introductory deep dive into Reverse Engineering, the process of deriving the internal workflows of a program from its compiled executable. The session focused on the core methodologies of taking software apart to understand its inner workings without access to source code, utilizing the decompiling and reverse engineering tool IDA Pro.

Reverse Engineering can be done for a few reasons, some key motivators being Malware Analysis (Understanding what a virus or trojan actually does), Vulnerability Research (Finding bugs in closed-source software), Game Hacking (Understanding internal game mechanics), Software Cracking (bypassing license- or pay-walls in software), and CTF Competitions.

We first overviewed some key concepts in Binary Formats and x86 Assembly that are necessary for parsing compiled machine code:

Binary Formats

We explored the structure of PE (Portable Executable) files used in Windows and ELF (Executable and Linkable Format) used in Linux, noting how these formats tell the OS where to start and what libraries to load.

Registers

Key x86 registers were reviewed, such as RAX (return values), RSP (stack pointer), and RIP (instruction pointer).

Instructions

We covered essential data movement (MOV, LEA), arithmetic (ADD, XOR), and control flow instructions (CMP, JMP, CALL, RET) that account for the majority of code encountered.

We then transitioned to a tutorial on IDA Pro, the industry-standard interactive disassembler. Some key features and workflows we discussed included:

Essential Views

Using the Graph View to visualize control flow, the Strings Window (Shift+F12) to identify critical text, and the Imports Window to see which external functions the binary calls.

Cross-References (Xrefs)

Using the X shortcut to find where specific functions or strings are used throughout the code.

Static vs. Dynamic Analysis

Understanding the difference between examining a binary without running it (Static) and observing its behavior during execution (Dynamic).

Finally, we covered a Static Analysis Workflow/Lifecycle for approaching an unknown binary, which involves three phases:

• •Triage: Identifying the file type and checking for packing.
• •Recon: Scanning the strings and imports windows.
• •Analysis: Following cross-references from interesting strings or imports and annotating the findings.

We closed off our meeting with a hands-on workshop to practice these techniques and check our knowledge.