Download a Software Called Ollydbg from Dc
Total Page：16
File Type：pdf, Size：1020Kb
Load more
Recommended publications
-
Reverse Software Engineering As a Project-Based Learning Tool
Paper ID #33764 Reverse Software Engineering as a Project-Based Learning Tool Ms. Cynthia C. Fry, Baylor University CYNTHIA C. FRY is currently a Senior Lecturer of Computer Science at Baylor University. She worked at NASA’s Marshall Space Flight Center as a Senior Project Engineer, a Crew Training Manager, and the Science Operations Director for STS-46. She was an Engineering Duty Officer in the U.S. Navy (IRR), and worked with the Naval Maritime Intelligence Center as a Scientific/Technical Intelligence Analyst. She was the owner and chief systems engineer for Systems Engineering Services (SES), a computer systems design, development, and consultation firm. She joined the faculty of the School of Engineering and Computer Science at Baylor University in 1997, where she teaches a variety of engineering and computer science classes, she is the Faculty Advisor for the Women in Computer Science (WiCS), the Director of the Computer Science Fellows program, and is a KEEN Fellow. She has authored and co- authored over fifty peer-reviewed papers. Mr. Zachary Michael Steudel Zachary Steudel is a 2021 graduate of Baylor University’s computer science department. In his time at Baylor, he worked as a Teaching Assistant under Ms. Cynthia C. Fry. As part of the Teaching Assistant role, Zachary designed and created the group project for the Computer Systems course. Zachary Steudel worked as a Software Developer Intern at Amazon in the Summer of 2019, a Software Engineer Intern at Microsoft in the Summer of 2020, and begins his full-time career with Amazon in the summer of 2021 as a software engineer. -
A Survey of Reverse Engineering Tools for the 32-Bit Microsoft Windows Environment
A Survey of Reverse Engineering Tools for the 32-Bit Microsoft Windows Environment RAYMOND J. CANZANESE, JR., MATTHEW OYER, SPIROS MANCORIDIS, and MOSHE KAM College of Engineering Drexel University, Philadelphia, PA, USA Reverse engineering is defined by Chikosfky and Cross as the process of analyzing a subject system to identify the system's components and their relationships, and to create representations of the system in another form or at a higher level of abstraction. The process of reverse engineering is accomplished using specific tools that, for the 32-bit Microsoft Windows environment, are categorized as hex editors, disassemblers/debuggers, decompilers, or related technologies such as code obfuscators, unpackers, and PE editors. An evaluation of each tool is provided that identifies its domain of applicability and usability. Categories and Subject Descriptors: A.1 [General]: Introductory and Survey; D.2.5 [Software Engineering]: Testing and Debugging General Terms: Security, Documentation Additional Key Words and Phrases: Reverse Engineering, Disassemblers, Debuggers, Decompilers, Code Obfuscators, PE Editors Unpackers, Hex Editors 1. INTRODUCTION 1.1 The Reverse Engineering Process Software engineers are sometimes asked to understand the behavior of a program given that program's binary executable file. If they have access to the appropriate reverse engineering tools, they might choose to adhere to the following process. First, a general disassembler/debugger is used to determine the basic functionality of the program. If disassembly and debugging shows that the binary code has been obfuscated, the next step would be to determine whether the obfuscator used is a common commercial obfuscator or a custom protection scheme. A PE editor would be used to make this determination. -
![Static and Dynamic Analysis [Repetition] IDA Pro and Ollydbg Obfuscated Code Analysis De-Obfuscation of Binaries Forensic Analysis of Unknown Files](https://docslib.b-cdn.net/cover/0967/static-and-dynamic-analysis-repetition-ida-pro-and-ollydbg-obfuscated-code-analysis-de-obfuscation-of-binaries-forensic-analysis-of-unknown-files-6990967.webp)
Static and Dynamic Analysis [Repetition] IDA Pro and Ollydbg Obfuscated Code Analysis De-Obfuscation of Binaries Forensic Analysis of Unknown Files
Forensics II Static and dynamic analysis [repetition] IDA Pro and OllyDbg Obfuscated code analysis De-obfuscation of binaries Forensic Analysis of unknown files • Before you begin check if you are allowed to examine! • Question to answer - what are the true functions and capabilities of the file/program? • Deep knowledge about the program may give additional benefits as – Anti-... methods – Damage control know how – Info about the creator Two analysis methods • Before you begin with any deeper analyse – Document as much as you know about the file • System location, OS, full path to file, etc. • Who found it? – Run a malware scan (can give quick result!) • Static analysis – No execution – Extensive search in the binary with various tools • Dynamic analysis – Execution – Extensive monitoring – Alter the execution and program flow Automatic malware analysis • Scan malware with different AntiVirus agents – If there is an alert, research AV manufacturers websites – If analysis is already done – 90% of your job may be done • AV report can be faulty, malcode may be of a new variant etc. • Web based static and dynamic analyze – http://www.virustotal.com – http://www.sunbeltsecurity.com - ThreatTrack Security – http://metascan-online.com/ • Indicators of Compromise (IOCs) – Mandiant IOC Editor and Finder – iDefense MAP (Malcode Analyst Pac) – FTK – Cerberus • Many other various solutions – Search! Landscape is changing constantly • ethical-hacker.net > Blog (Tools and Techniques) – http://ethicalhackernet.blogspot.com/2008_04_01_archive.html Cerberus Cerberus Stage 1 Score Static analysis methods (Linux) hjo@lnx:~/$ file winkill winkill: ELF 32-bit LSB executable, Intel • Hash the file 80386, version 1 (SYSV), for GNU/Linux 2.0.0, dynamically linked (uses shared libs), • File for GNU/Linux 2.0.0, not stripped – Properties and type of file etc. -
Advanced Artefact Analysis Introduction to Advanced Artefact Analysis
Advanced Artefact Analysis Introduction to advanced artefact analysis HANDBOOK, DOCUMENT FOR TEACHERS OCTOBER 2015 www.enisa.europa.eu European Union Agency For Network And Information Security Advanced Artefact Analysis Introduction to advanced artefact analysis About ENISA The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu. Authors This document was created by Yonas Leguesse, Christos Sidiropoulos, Kaarel Jõgi and Lauri Palkmets in consultation with ComCERT1 (Poland), S-CURE2 (The Netherlands) and DFN-CERT Services (Germany). Contact For contacting the authors please use [email protected] For media enquiries about this paper, please use [email protected]. Acknowledgements ENISA wants to thank all institutions and persons who contributed to this document. A special ‘Thank You’ goes to Filip Vlašić, and Darko Perhoc. Legal notice Notice must be taken that this publication represents the views and interpretations of the authors and editors, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the Regulation (EU) No 526/2013.