Cryptography Security Models The black-box security model is when attackers view cryptographic tools as oracles that follow a particular API. It is mainly used by cryptographers to prove the security of cryptographic schemes, often by reducing the security of a cryptographic algorithm to the hardness of a hard problem, such

Symbolic Execution In computer science, symbolic execution is a means of analyzing a program to determine what inputs cause each part of a program to execute. Source: Wikipedia In other words, one looks to follow the execution flow of a program by assuming symbolic values (i.e., x, y, z)

Goals and Limits Anti-debug techniques, or anti-debug tricks, are methods that make debugging more difficult. The general process is to detect a debugger or debugging technique and respond accordingly. The response should be clever and not too close to the time of detection. Reliability is also an issue to consider:

Code Virtualization Code virtualization is a very powerful obfuscation technique. The main idea is to transform a function or application into an interpreter (virtual machine) and a corresponding bytecode that is interpreted at runtime. The goal is to make the reverse engineer understand how the interpreter works before understanding how

Code Obfuscation The basic idea of code obfuscation is to transform a piece of code into a version that is functionally equivalent, but more difficult to reverse engineer. The goal is to remove all the abstractions that the developer has added in order to create a well-modularized and easy-to-maintain code.

Threat Models A traditional threat model used for software security is the following: software runs remotely, in the form of a dynamic web page, a remote API, or a network daemon, as shown in the figure below: To protect that software from external threat vectors (the red arrows), you can

Basics In the context of computer programming, instrumentation refers to the measure of a product's performance, to diagnose errors, and to write trace information. Instrumentation can be of two types: source instrumentation and binary instrumentation. Source: Wikipedia Instrumentation is the ability of an application to incorporate the following:

Hooking Shared Libraries Sometimes, it's useful to hook calls to shared libraries. On Linux, you can do this by using the LD_PRELOAD environment variable. Let's look at an example to understand this better. Here is a toy C code: #include <stdlib.h> #include

Debuggers A debugger or debugging tool is a computer program that is used to test and debug other programs (the target program). Source: Wikipedia The typical functionalities of a debugger include: * a query processor; * a symbol resolver; * an expression interpreter; * single-stepping an executable, either at the source-code level for source-level

Interpreted Languages In computer science, an interpreter is a computer program that directly executes instructions written in a programming or scripting language, without requiring them previously to have been compiled into a machine language program. Source: Wikipedia The following languages are interpreted: Java, Python, Ruby, Perl, PHP, Postscript, etc. Reverse

C Programming Language The C programming language is the oldest system programming language that is still widely used today. Native code decompilers usually produce C code as a result. There are no complex language-specific artifacts. Executables are usually dynamically linked with the libc and they are rather small. C++ Programming

Process Loading under Linux The Linux operating system uses the execve system call or one of its variants to load a process. First, the kernel allocates internal structures. Then, it parses the given ELF file. If the ELF file has a specified interpreter field, it is executed. For executables that

Executable Formats [...] executable code, an executable file, or an executable program, sometimes simply referred to as an executable or binary, causes a computer "to perform indicated tasks according to encoded instructions", as opposed to a data file that must be interpreted (parsed) by a program to be meaningful.

Basics A calling convention is a low-level standard scheme for how subroutines receive parameters from their caller and how they return a result. It specifies the following: * the order in which scalar parameters are allocated; * how parameters are passed (pushed on the stack, placed in registers, or a mix of

ARM Architecture The initials ARM, which are an acronym for Acorn RISC Machine, were subsequently shortened to Advanced RISC Machine. The ARM architecture family is used in most smartphones, tablets, and embedded systems, as well as some laptops, because it uses less energy and costs less. The main business of

Intel Architecture The Intel architecture is a little-endian, Complex Instruction Set Computer (CISC) architecture. The 32-bit version is called x86 or IA-32, while the 64-bit version is called x64 or x86-64; don't confuse it with the discontinued IA-64 (Itanium) architecture. A comprehensive documentation of the architecture is available

In this episode, I will list several tools that are useful for performing software reverse engineering. We will return to some of them in further detail later. Small Utility Tools A first useful tool is strings. Here is a small excerpt from its man page: For each file given, strings

From the Source Code to an Executable and Back The following figure illustrates the different generic stages of software and the tools used to move from one stage to another. Starting from any source code (C, C++, Rust, Java, Python, etc.) in ❶, the first stage of a compiler ❷, called the

What is Reverse Engineering? Reverse engineering [...] is a process or method through which one attempts to understand through deductive reasoning how a previously made device, process, system, or piece of software accomplishes a task with very little (if any) insight into exactly how it does so. Source: Wikipedia In the