commit 683a130664be4df0ae36dd7a21205c68ef68af9e Author: gurkenhabicht Date: Wed Nov 15 19:52:07 2023 +0100 init diff --git a/README.md b/README.md new file mode 100644 index 0000000..b4cf143 --- /dev/null +++ b/README.md @@ -0,0 +1,3 @@ +# Presentations + +This will be a collection of presentations. diff --git a/introduction-to-reverse-engineering/build-presentation.sh b/introduction-to-reverse-engineering/build-presentation.sh new file mode 100755 index 0000000..f649204 --- /dev/null +++ b/introduction-to-reverse-engineering/build-presentation.sh @@ -0,0 +1,3 @@ +#!/usr/bin/env bash + +pandoc -s --mathml -i -t revealjs reverse_engineering.md -o presentation.html -V theme=dracula diff --git a/introduction-to-reverse-engineering/images/Ghidra-Overview.png b/introduction-to-reverse-engineering/images/Ghidra-Overview.png new file mode 100644 index 0000000..597b5bf Binary files /dev/null and b/introduction-to-reverse-engineering/images/Ghidra-Overview.png differ diff --git a/introduction-to-reverse-engineering/images/data-segments.png b/introduction-to-reverse-engineering/images/data-segments.png new file mode 100644 index 0000000..6c51a33 Binary files /dev/null and b/introduction-to-reverse-engineering/images/data-segments.png differ diff --git a/introduction-to-reverse-engineering/images/decompiled-code.png b/introduction-to-reverse-engineering/images/decompiled-code.png new file mode 100644 index 0000000..1cb81cc Binary files /dev/null and b/introduction-to-reverse-engineering/images/decompiled-code.png differ diff --git a/introduction-to-reverse-engineering/images/defined-strings-menu.png b/introduction-to-reverse-engineering/images/defined-strings-menu.png new file mode 100644 index 0000000..b59dc38 Binary files /dev/null and b/introduction-to-reverse-engineering/images/defined-strings-menu.png differ diff --git a/introduction-to-reverse-engineering/images/defined-strings.png b/introduction-to-reverse-engineering/images/defined-strings.png new file mode 100644 index 0000000..55172e4 Binary files /dev/null and b/introduction-to-reverse-engineering/images/defined-strings.png differ diff --git a/introduction-to-reverse-engineering/images/function-graph.png b/introduction-to-reverse-engineering/images/function-graph.png new file mode 100644 index 0000000..162eb52 Binary files /dev/null and b/introduction-to-reverse-engineering/images/function-graph.png differ diff --git a/introduction-to-reverse-engineering/images/london_by_foot.jpg b/introduction-to-reverse-engineering/images/london_by_foot.jpg new file mode 100644 index 0000000..d134e2e Binary files /dev/null and b/introduction-to-reverse-engineering/images/london_by_foot.jpg differ diff --git a/introduction-to-reverse-engineering/images/london_underground.jpg b/introduction-to-reverse-engineering/images/london_underground.jpg new file mode 100644 index 0000000..997be81 Binary files /dev/null and b/introduction-to-reverse-engineering/images/london_underground.jpg differ diff --git a/introduction-to-reverse-engineering/images/symbol-tree.png b/introduction-to-reverse-engineering/images/symbol-tree.png new file mode 100644 index 0000000..9706654 Binary files /dev/null and b/introduction-to-reverse-engineering/images/symbol-tree.png differ diff --git a/introduction-to-reverse-engineering/presentation.html b/introduction-to-reverse-engineering/presentation.html new file mode 100644 index 0000000..fe8f27c --- /dev/null +++ b/introduction-to-reverse-engineering/presentation.html @@ -0,0 +1,348 @@ + + + + + + + Introduction to Reverse Engineering + + + + + + + + + +
+
+ +
+

Introduction to Reverse Engineering

+

Stefan Friese

+

02 November, 2023

+
+ +
+

Topics

+
    +
  • Effective Reverse Engineering
    • +
  • Reversing with Ghidra
    • +
+
+
+ +

How Do You Reverse

+

Reverse Engineering demands a lot of knowledge in multiple +fields.

+

Some topics are

+
    +
  • Assembly Language
    • +
  • ANSI C
    • +
  • Other Languages
    • +
  • Syscalls
    • +
  • Cryptography
    • +
+
+
+ +

How do you reverse engineer without knowing little about these +topics?

+
+
+ +

Reversing is Work

+

Work is a product of power by time.
+P is your power to solve an issue.

+

W = P x t

+

The smarter you tackle work, the less time you need to solve an +issue.

+
+
+ +

Knowledge is a Map

+

You conventiently drive around the city using the underground. That’s +how you get to know the main spots of the city.

+

London Underground

+
+
+ +

Knowledge is a Map

+

Invest some time and explore deeper on foot. That’s how you get to +know the back alleys.

+

London by Foot

+
+
+

Ghidra – an Overview

+
+
+ +
+ + +
+
+
+ +

Watch Out for Low Hanging +Fruits

+
+
+ +
    +
  • Data Segment
    • +
  • Names of Functions
    • +
  • Conditions & Comparisons
    • +
  • Strings: Usernames, Passwords
    • +
  • URLs, IP & Port Numbers
    • +
+

Do not try to understand the whole code at once, it will only +drive you mad.

+
+
+ +

Data Segments

+
+ + +
+
+
+ +

Name of Functions

+
+ + +
+
+
+ +

Conditions & Comparisions

+

Input is Compared to a Hard Coded String

+

Input is compared to a hard coded string

+
+
+ +

Function Graph

+

Take a Look at the Flow Graph of Functions

+

Take a look at the flow graph of functions

+
+
+ +

Strings

+

Open the Defined Strings Menu

+

Strings can not only be located in data but also in other code +segments, sometimes obfuscated

+
+
+ +

Strings

+
+An old friend + +
+
+
+ +

Do It Yourselves!

+ +
+
+
+ + + + + + + + + + + diff --git a/introduction-to-reverse-engineering/reverse_engineering.md b/introduction-to-reverse-engineering/reverse_engineering.md new file mode 100644 index 0000000..9d1d60d --- /dev/null +++ b/introduction-to-reverse-engineering/reverse_engineering.md @@ -0,0 +1,131 @@ +% Introduction to Reverse Engineering +% Stefan Friese +% 02 November, 2023 + +--- + +# Topics + +* Effective Reverse Engineering +* Reversing with Ghidra + +--- + +## How Do You Reverse + +Reverse Engineering demands a lot of knowledge in multiple fields. + +**Some topics are** + +* Assembly Language +* ANSI C +* Other Languages +* Syscalls +* Cryptography + +--- + +How do you reverse engineer without knowing little about these topics? + +--- + +## Reversing is Work + +Work is a product of power by time. +`P` is your power to solve an issue. + +`W = P x t` + +The smarter you tackle work, the less time you need to solve an issue. + +--- + +## Knowledge is a Map + +You conventiently drive around the city using the underground. +That's how you get to know the main spots of the city. + +London Underground + +--- + +## Knowledge is a Map + +Invest some time and explore deeper on foot. +That's how you get to know the back alleys. + +London by Foot + +--- + +# Ghidra -- an Overview + +--- + +![Main View of Ghidra](./images/Ghidra-Overview.png) + +--- + +## Watch Out for Low Hanging Fruits + +--- + +* Data Segment +* Names of Functions +* Conditions & Comparisons +* Strings: Usernames, Passwords +* URLs, IP & Port Numbers + +**Do not try to understand the whole code at once, it will only drive you mad.** + +--- + +### Data Segments + +![A look into the read only data segment](./images/data-segments.png) + +--- + +### Name of Functions + +![Functions contained in the binary a.k.a. Symbol Tree](./images/symbol-tree.png) + +--- + +### Conditions & Comparisions + +Input is Compared to a Hard Coded String + +Input is compared to a hard coded string + +--- + +### Function Graph + +Take a Look at the Flow Graph of Functions + +Take a look at the flow graph of functions + +--- + +### Strings + +Open the Defined Strings Menu + +Strings can not only be located in data but also in other code segments, sometimes obfuscated + +--- + +### Strings + +![An old friend](./images/defined-strings.png) + +--- + +### Do It Yourselves! + +* [Download Ghidra](https://ghidra-sre.org/) +* [Download binaries at crackmes.one](https://crackmes.one) +* [Find more binaries on hackthebox](https://hackthebox.eu) +* [Or Find even more on tryhackme](https://tryhackme.com) +* Download firmware of your favorite IoT appliances