Reversing: Secrets of Reverse Engineering

Last updated
Reversing: Secrets of Reverse Engineering
Reversing secrets of reverse engineering cover.jpg
Author Eldad Eilam
Country United States, Canada, China, Japan, EMEA
Language English
Subject Reverse engineering
Publisher Wiley Publishing
Publication date
2005
Pages595
ISBN 0-7645-7481-7
OCLC 60359199
005.1 22
LC Class QA76.758 .E35 2005

Reversing: Secrets of Reverse Engineering is a textbook written by Eldad Eilam on the subject of reverse engineering software, mainly within a Microsoft Windows environment. It covers the use of debuggers and other low-level tools for working with binaries. Of particular interest is that it uses OllyDbg in examples, and is therefore one of the few practical, modern books on the subject that uses popular, real-world tools to facilitate learning. The book is designed for independent study and does not contain problem sets, but it is also used as a course book in some university classes.[ citation needed ]

Contents

The book covers several different aspects of reverse engineering, and demonstrates what can be accomplished:

The book also includes a detailed discussion of the legal aspects of reverse engineering, and examines some famous court cases and rulings that were related to reverse engineering.

Considering its relatively narrow subject matter, Reversing is a bestseller that has remained on Amazon.com's list of top 100 software books for several years, since its initial release. [1] [2]

Chapter Outline

Editions

Related Research Articles

<span class="mw-page-title-main">Software</span> Non-tangible executable component of a computer

Software is a set of computer programs and associated documentation and data. This is in contrast to hardware, from which the system is built and which actually performs the work.

Computer programming is the process of performing a particular computation, usually by designing and building an executable computer program. Programming involves tasks such as analysis, generating algorithms, profiling algorithms' accuracy and resource consumption, and the implementation of algorithms. The source code of a program is written in one or more languages that are intelligible to programmers, rather than machine code, which is directly executed by the central processing unit. The purpose of programming is to find a sequence of instructions that will automate the performance of a task on a computer, often for solving a given problem. Proficient programming thus usually requires expertise in several different subjects, including knowledge of the application domain, specialized algorithms, and formal logic.

<span class="mw-page-title-main">Microsoft Excel</span> Spreadsheet editor, part of Microsoft Office

Microsoft Excel is a spreadsheet developed by Microsoft for Windows, macOS, Android, iOS and iPadOS. It features calculation or computation capabilities, graphing tools, pivot tables, and a macro programming language called Visual Basic for Applications (VBA). Excel forms part of the Microsoft 365 suite of software.

In computing, source code, or simply code, is any collection of text, with or without comments, written using a human-readable programming language, usually as plain text. The source code of a program is specially designed to facilitate the work of computer programmers, who specify the actions to be performed by a computer mostly by writing source code.

Software cracking is an act of removing copy protection from a software. Copy protection can be removed by applying a specific crack. A crack would refer to any tool to enable breaking into a computer network or a software application. Examples of cracks are: applying a patch or by creating reverse-engineered serial number generators known as keygens, thus bypassing software registration and payments or converting a trial/demo version of the software into fully-functioning software without paying for it. Software cracking contributes to the rise of online piracy where pirated software is distributed to end-users through filesharing sites like BitTorrent, One click hosting (OCH), or via Usenet downloads, or by downloading bundles of the original software with cracks or keygens.

<span class="mw-page-title-main">Debugger</span> Computer program used to test and debug other programs

A debugger or debugging tool is a computer program used to test and debug other programs. The main use of a debugger is to run the target program under controlled conditions that permit the programmer to track its execution and monitor changes in computer resources that may indicate malfunctioning code. Typical debugging facilities include the ability to run or halt the target program at specific points, display the contents of memory, CPU registers or storage devices, and modify memory or register contents in order to enter selected test data that might be a cause of faulty program execution.

<span class="mw-page-title-main">Fravia</span>

Francesco Vianello, better known by his nickname Fravia, was a software reverse engineer, who maintained a web archive of reverse engineering techniques and papers. He also worked on steganography. He taught on subjects such as data mining, anonymity and stalking.

A programming tool or software development tool is a computer program that software developers use to create, debug, maintain, or otherwise support other programs and applications. The term usually refers to relatively simple programs, that can be combined to accomplish a task, much as one might use multiple hands to fix a physical object. The most basic tools are a source code editor and a compiler or interpreter, which are used ubiquitously and continuously. Other tools are used more or less depending on the language, development methodology, and individual engineer, often used for a discrete task, like a debugger or profiler. Tools may be discrete programs, executed separately – often from the command line – or may be parts of a single large program, called an integrated development environment (IDE). In many cases, particularly for simpler use, simple ad hoc techniques are used instead of a tool, such as print debugging instead of using a debugger, manual timing instead of a profiler, or tracking bugs in a text file or spreadsheet instead of a bug tracking system.

Commercial software, or seldom payware, is a computer software that is produced for sale or that serves commercial purposes. Commercial software can be proprietary software or free and open-source software.

<span class="mw-page-title-main">Interactive Disassembler</span> Software reverse engineering tool

The Interactive Disassembler (IDA) is a disassembler for computer software which generates assembly language source code from machine-executable code. It supports a variety of executable formats for different processors and operating systems. It can also be used as a debugger for Windows PE, Mac OS X Mach-O, and Linux ELF executables. A decompiler plug-in, which generates a high level, C source code-like representation of the analysed program, is available at extra cost.

<span class="mw-page-title-main">Continuous integration</span> Software development practice based on frequent submission of granular changes

In software engineering, continuous integration (CI) is the practice of merging all developers' working copies to a shared mainline several times a day. Nowadays it is typically implemented in such a way that it triggers an automated build with testing. Grady Booch first proposed the term CI in his 1991 method, although he did not advocate integrating several times a day. Extreme programming (XP) adopted the concept of CI and did advocate integrating more than once per day – perhaps as many as tens of times per day.

Free/open-source software – the source availability model used by free and open-source software (FOSS) – and closed source are two approaches to the distribution of software.

Amiga Disk File (ADF) is a file format used by Amiga computers and emulators to store images of floppy disks. It has been around almost as long as the Amiga itself, although it was not initially called by any particular name. Before it was known as ADF, it was used in commercial game production, backup and disk virtualization. ADF is a track-by-track dump of the disk data as read by the Amiga operating system, and so the "format" is really fixed-width AmigaDOS data tracks appended one after another and held in a file. This file would, typically, be formatted, like the disk, in Amiga Old File System (OFS).

In computing, computer performance is the amount of useful work accomplished by a computer system. Outside of specific contexts, computer performance is estimated in terms of accuracy, efficiency and speed of executing computer program instructions. When it comes to high computer performance, one or more of the following factors might be involved:

Tagès was a software copy protection system, jointly developed, at first, by MPO and the Thales Group starting in 1999. Its method of protection has since been described as twin sectors.

Proprietary software is software that is deemed within the free and open-source software community to be non-free because its creator, publisher, or other rightsholder or rightsholder partner exercises a legal monopoly by modern copyright and intellectual property law to exclude the recipient from freely sharing the software or modifying it, and—in some cases, as is the case with some patent-encumbered and EULA-bound software—from making use of the software on their own, thereby restricting their freedoms. It is often contrasted with open-source or free software. For this reason, it is also known as non-free software or closed-source software.

Reverse engineering is a process or method through which one attempts to understand through deductive reasoning how a previously made device, process, system, or piece of software accomplishes a task with very little insight into exactly how it does so. It is essentially the process of opening up or dissecting a system to see how it works, in order to duplicate or enhance it. Depending on the system under consideration and the technologies employed, the knowledge gained during reverse engineering can help with repurposing obsolete objects, doing security analysis, or learning how something works.

A decompiler is a computer program that translates an executable file to high-level source code. It does therefore the opposite of a typical compiler, which translates a high-level language to a low-level language. While disassemblers translate an executable into assembly language, decompilers go a step further and translate the code into a higher level language such as C or Java, requiring more sophisticated techniques. Decompilers are usually unable to perfectly reconstruct the original source code, thus will frequently produce obfuscated code. Nonetheless, they remain an important tool in the reverse engineering of computer software.

<i>Bowers v. Baystate Technologies, Inc.</i>

Bowers v. Baystate Technologies, 320 F.3d 1317, was a U.S. Court of Appeals Federal Circuit case involving Harold L. Bowers and Baystate Technologies over patent infringement, copyright infringement, and breach of contract. In the case, the court found that Baystate had breached their contract by reverse engineering Bower's program, something expressly prohibited by a shrink wrap license that Baystate entered into upon purchasing a copy of Bower's software. This case is notable for establishing that license agreements can preempt fair use rights as well as expand the rights of copyright holders beyond those codified in US federal law.

<span class="mw-page-title-main">BOSH (software)</span>

BOSH is an open-source software project that offers a toolchain for release engineering, software deployment and application lifecycle management of large-scale distributed services. The toolchain is made up of a server and a command line tool. BOSH is typically used to package, deploy and manage cloud software. While BOSH was initially developed by VMware in 2010 to deploy Cloud Foundry PaaS, it can be used to deploy other software. BOSH is designed to manage the whole lifecycle of large distributed systems.

References