| Contents Notes |
This book provides a systematic approach to reverse engineering. Reverse engineering is not about reading assembly code, but actually understanding how different pieces/components in a system work. To reverse engineer a system is to understand how it is constructed and how it works. The book provides: Coverage of x86, x64, and ARM. In the past x86 was the most common architecture on the PC; however, times have changed and x64 is becoming the dominant architecture. It brings new complexity and constructs previously not present in x86. ARM (Advanced RISC Machine) is very common in embedded / consumer electronic devices; for example, most if not all cell phones run on ARM. All of apple's i-devices run on ARM. This book will be the first book to cover all three. Discussion of Windows kernel-mode code (rootkits/drivers). This topic has a steep learning curve so most practitioners stay away from this area because it is highly complex. However, this book will provide a concise treatment of this topic and explain how to analyze drivers step-by-step. The book uses real world examples from the public domain. The best way to learn is through a combination of concept discussions, examples, and exercises. This book uses real-world trojans / rootkits as examples congruent with real-life scenarios and Hands-on exercises. Cover; Title Page; Copyright; Contents; Chapter 1 x86 and x64; Register Set and Data Types; Instruction Set; Syntax; Data Movement; Exercise; Arithmetic Operations; Stack Operations and Function Invocation; Exercises; Control Flow; System Mechanism; Address Translation; Interrupts and Exceptions; Walk-Through; Exercises; x64; Register Set and Data Types; Data Movement; Canonical Address; Function Invocation; Exercises; Chapter 2 ARM; Basic Features; Data Types and Registers; System-Level Controls and Settings; Introduction to the Instruction Set; Loading and Storing Data; LDR and STR. Other Usage for LDRLDM and STM; PUSH and POP; Functions and Function Invocation; Arithmetic Operations; Branching and Conditional Execution; Thumb State; Switch-Case; Miscellaneous; Just-in-Time and Self-Modifying Code; Synchronization Primitives; System Services and Mechanisms; Instructions; Walk-Through; Next Steps; Exercises; Chapter 3 The Windows Kernel; Windows Fundamentals; Memory Layout; Processor Initialization; System Calls; Interrupt Request Level; Pool Memory; Memory Descriptor Lists; Processes and Threads; Execution Context; Kernel Synchronization Primitives; Lists. Implementation DetailsWalk-Through; Exercises; Asynchronous and Ad-Hoc Execution; System Threads; Work Items; Asynchronous Procedure Calls; Deferred Procedure Calls; Timers; Process and Thread Callbacks; Completion Routines; I/O Request Packets; Structure of a Driver; Entry Points; Driver and Device Objects; IRP Handling; A Common Mechanism for User-Kernel Communication; Miscellaneous System Mechanisms; Walk-Throughs; An x86 Rootkit; An x64 Rootkit; Next Steps; Exercises; Building Confidence and Solidifying Your Knowledge; Investigating and Extending Your Knowledge. Analysis of Real-Life DriversChapter 4 Debugging and Automation; The Debugging Tools and Basic Commands; Setting the Symbol Path; Debugger Windows; Evaluating Expressions; Process Control and Debut Events; Registers, Memory, and Symbols; Breakpoints; Inspecting Processes and Modules; Miscellaneous Commands; Scripting with the Debugging Tools; Pseudo-Registers; Aliases; Language; Script Files; Using Scripts Like Functions; Example Debug Scripts; Using the SDK; Concepts; Writing Debugging Tools Extensions; Useful Extensions, Tools, and Resources; Chapter 5 Obfuscation. A Survey of Obfuscation TechniquesThe Nature of Obfuscation: A Motivating Example; Data-Based Obfuscations; Control-Based Obfuscation; Simultaneous Control-Flow and Data-Flow Obfuscation; Achieving Security by Obscurity; A Survey of Deobfuscation Techniques; The Nature of Deobfuscation: Transformation Inversion; Deobfuscation Tools; Practical Deobfuscation; Case Study; First Impressions; Analyzing Handlers Semantics; Symbolic Execution; Solving the Challenge; Final Thoughts; Exercises; Appendix Sample Names and Corresponding SHA1 Hashes; Index. |
