Reversing: Secrets of Reverse Engineering

If you want to know how something works, you take it apart very carefully. That's exactly what this book shows you—how to deconstruct software in a way that reveals design and implementation details, sometimes even source code. Why? Because reversing reveals weak spots, so you can target your security efforts. Because you can reverse-engineer malicious code in order to neutralize it. Because understanding what makes a program work lets you build a better one. You'll learn how here.

• Learn to read compiler-generated assembly language code for IA-32 compatible processors
• Decipher an undocumented file format or network protocol
• Understand when reverse engineering is legal, and when—and why—it may not be
• See how hackers use reversing to defeat copy protection technology
• Find out how to pull the plug on malicious code
• Determine how to prevent others from reversing your code, and find out how effective such steps can be
• Explore reverse engineering on the .NET platform and its assembly language, MSIL
• Observe the dissection of a real-world malicious program and see how the attacker used it to control infected systems

applications of reverse engineering, this book provides readers with practical, in-depth techniques for software reverse engineering. The book is broken into two parts, the first deals with security-related reverse engineering and the second explores the more practical aspects of reverse engineering. In addition, the author explains how to reverse engineer a third-party software library to improve interfacing and how to reverse engineer a competitor's software to build a better product.

* The first popular book to show how software reverse engineering can help defend against security threats, speed up development, and unlock the secrets of competitive products

* Helps developers plug security holes by demonstrating how hackers exploit reverse engineering techniques to crack copy-protection schemes and identify software targets for viruses and other malware

* Offers a primer on advanced reverse-engineering, delving into "disassembly"-code-level reverse engineering-and explaining how to decipher assembly language

Acknowledgments xi

Introduction xxiii

Part I Reversing 101 1

Chapter 1 Foundations 3

Chapter 2 Low-Level Software 25

Chapter 3 Windows Fundamentals 69

Chapter 4 Reversing Tools 109

Part II Applied Reversing 139

Chapter 5 Beyond the Documentation 141

Chapter 6 Deciphering File Formats 199

Chapter 7 Auditing Program Binaries 243

Part III Cracking 307

Chapter 9 Piracy and Copy Protection 309

Chapter 10 Antireversing Techniques 327

Chapter 11 Breaking Protections 357

Part IV Beyond Disassembly 421

Chapter 12 Reversing .NET 423

Chapter 13 Decompilation 457

Appendix A Deciphering Code Structures 479

Appendix B Understanding Compiled Arithmetic 519

Appendix C Deciphering Program Data 537

Appendix D Citations 561

Index 567